2- Customer data

Types of data collected

Non-technical data (as required by the usage)

• identity and identification (family name, given name, date of birth, pseudonym and customer number)
• contact details (email, postal address and telephone number)
• professional details/personal details where necessary

Technical data (as required by the usage)

• identification data (IP address)
• access data (in particular logs and tokens)
• acceptance data (clicks)
• location data

Origin of data

We collect prospective customers’ data from:

• data provided by the customer (paper form, order form, contract or business card),
• electronic records or forms completed by the prospective customer,
• data provided online (website, social media, etc.),
• registration for events or competitions that we organise,
• databases shared between several partners, populated and used by all these partners,
• on rare occasions, databases we rent,
• contact details provided by specialist companies or partners.

Purposes

As appropriate to the situation, we process our prospective customers’ data for the following purposes:

• managing customer relationships,
• selling breaks directly or via partner distributors,
• managing events that we organise,
• sending out newsletters or information feeds,
• managing customer accounts,
• improving our services,
• fulfilling our administrative obligations,
• managing communities,
• producing statistics.

Retention periods

The retention period for our customers’ data is defined in accordance with the legal and contractual constraints by which we are bound and, in the absence of these, according to our needs, based among others on the following principles:

Customer data: For the duration of the contractual relationship, and then for an additional three years afterwards for community management and sales development purposes, without prejudice to retention obligations or limitation periods.
Technical data: 1 year from the collection date
Cookies: 13 months
Once the periods set have expired, data is either deleted, or anonymised and then retained, in particular for statistical purposes. It can also be retained if a dispute is foreseen or in progress.
Customers are reminded that deleting and anonymising data are irreversible operations. Once they have been completed, the data cannot be restored.

Lawful basis

All the processing operations that we carry out under this policy have as a lawful basis the performance of a contract, including entering into the contract, or, in certain cases, customer consent (e.g. to send direct marketing messages).

2- Partner data

Types of data collected

Non-technical data (as required by the usage)

• identity and identification (family name, given name, date of birth and pseudonym)
• contact details (email, postal address and telephone number)
• professional details (role, job title, etc.)

Technical data (as required by the usage)

• identification data (IP address)
• access data (in particular logs and tokens)
• acceptance data (clicks)
• location data

Origin of data

We collect partners’ data from:

• information provided directly by the partners,
• electronic records or forms completed by the partners,
• registrations and sign-ups to our online services (newsletter, social media, etc.).

Purposes

As appropriate to the situation, we process our partners’ data for the following purposes:

• managing customer relationships,
• awarding labels to sites and facilities in instances where our organisation has been entrusted with this function,
• managing tourism projects (analyses and feasibility studies, support for grant applications and grant application projects),
• creating networks or discussion fora involving various partners,
• assisting partner service providers to bring their services to the market,
• managing events that we organise (trade shows, workshops, AGMs, trade networking events, etc.),
• training partner service providers,
• identifying partner distributors,
• producing statistics.

Retention periods

The retention period for our partners’ data is defined in accordance with the legal and contractual constraints by which we are bound and, in the absence of these, according to our needs, based among others on the following principles:

Partner data: For the duration of the contractual relationship, and then for an additional three years afterwards for the purpose of following up the relationship, without prejudice to retention obligations or limitation periods.
Technical data: 1 year from the collection date
Cookies: 13 months
Once the periods set have expired, data is either deleted, or anonymised and then retained, in particular for statistical purposes. It can also be retained if a dispute is foreseen or in progress.
Partners are reminded that deleting and anonymising data are irreversible operations. Once they have been completed, the data cannot be restored.

Lawful basis

All the processing operations that we carry out under this policy have as a lawful basis:

• our organisation’s legitimate interest,
• the performance of a contract, including entering into the contract.

4- Prospective customer data

Types of data collected

Non-technical data (as required by the usage)

• identity and identification (family name, given name, date of birth, pseudonym and customer number)
• contact details (email, postal address and telephone number)
• professional details (role, job title, etc.)

Technical data (as required by the usage)

• identification data (IP address)
• access data (in particular logs and tokens)
• acceptance data (clicks)
• location data

Origin of data

We collect prospective customers’ data from:

• data supplied by the prospective customer (paper form, business card, etc.),
• electronic records or forms completed by the prospective customer,
• data provided online (website, social media, etc.),
• registrations and sign-ups to our online services (website, social media, etc.),
• registration for events or competitions that we organise,
• databases shared between several partners, populated and used by all these partners,
• lists provided by the organisers of events or conferences in which we are involved,
• on rare occasions, databases we rent,
• contact details provided by specialist companies or partners.

Purposes

As appropriate to the situation, we process our prospective customers’ data for the following purposes:

• managing prospective customer relationships,
• managing events and competitions that we organise,
• sending out our newsletters or information feeds,
• managing websites in conjunction with our partners,
• promoting our organisation and tourism in Alsace and in the Vosges Mountains on social media (Facebook, Twitter, YouTube, Instagram, etc.),
• analysing the behaviour of prospective customers,
• managing communities,
• producing statistics.

Retention periods

The retention period for our prospective customers’ data is defined in accordance with the legal and contractual constraints by which we are bound and, in the absence of these, according to our needs, based among others on the following principles:

Prospective customer data: 3 years from the collection date or the last contact from the prospective customer
Technical data: 1 year from the collection date
Cookies: 13 months
Once the periods set have expired, data is either deleted, or anonymised and then retained, in particular for statistical purposes. It can also be retained if a dispute is foreseen or in progress.
Prospective customers are reminded that deleting and anonymising data are irreversible operations. Once they have been completed, the data cannot be restored.

Lawful basis

The purposes of processing for the prospective customer data described above are covered by the following lawful bases:

• preparation to enter into a contract,
• our organisation’s legitimate interest,
• the prospective customer’s consent where the law requires this (for example to send direct marketing messages).

5- Data recipients

We ensure that data can only be accessed by authorised internal and external recipients, who are bound by an appropriate duty of confidentiality. Within our organisation, we use an authorisation policy to decide which recipients can access which data.
Traceability measures are in place for any access involving our customers’, partners’ or prospective customers’ data.
In addition, personal data can be communicated to any authority legally entitled to have knowledge of it. In such cases, we cannot be held responsible for the conditions under which the staff of these authorities access and use the data.

Internal recipients: 

• Authorised staff within our organisation (staff in charge of marketing and customer, service provider and prospective customer relationship management, administrative staff and IT staff) and their line managers.

External recipients: 

• tourism industry partners who access the shared file in which the data may appear
• service providers and support services
• authorised oversight service staff (auditor, departments responsible for carrying out internal controls, etc.)
• administrative authorities and officers of the law or justice system, as appropriate

6- Rights of data subjects

Right of access and copy

Conventionally, customers, partners and prospective customers have the right to ask for confirmation as to whether data about them has been processed or not.
They also have the right to access their data, meaning the right to obtain full information regarding the processing of their personal data.
Should a customer, partner or prospective customer wish to exercise this right, they must submit the request personally and there must be no doubt as to their identity. If there is a doubt, we reserve the right to ask the person to provide proof of their identity in the format of their choice. This is most frequently a copy of their identity document.
Customers, partners and prospective customers have the right to request a copy of their personal data that is being processed. If, however, they request a further copy, we may require them to cover the cost of this.
If the customer, partner or prospective customer sends their request for a copy of their data in an electronic format, the required information will be provided in a standard electronic format, unless otherwise requested.
Customers, partners and prospective customers should be aware that this right to access data does not extend to confidential data or information, nor to any data or information which may not legally be communicated.
The right to access must not be exercised inappropriately, meaning that requests must not be submitted on a regular basis with the sole objective of disrupting the department concerned.

Updates and rectifications

We will perform requested updates and rectifications:

• automatically when a change is made online to fields that can technically or legally be updated;
• on receipt of a written request from the person in question, who must provide proof of identity.

Right to erasure

The right to erasure of a customer’s, partner’s or prospective customer’s data will not be applicable in cases where the processing is carried out on the basis of a legal obligation. In other situations, customers, partners and prospective customers have the right to ask for their data to be erased in the following cases only:

• the personal data is no longer required for the purposes for which it was collected or otherwise processed,
• the data subject is withdrawing the consent on which the processing is based and there is no other legal basis for processing,
• the data subject is objecting to processing carried out in our legitimate interest, and there is no other compelling legitimate interest for the processing,
• the data subject is objecting to the use of their personal data for direct marketing purposes, including profiling,
• the personal data has been processed unlawfully.

Right to restrict processing

Customers, partners and prospective customers are informed that this right does not apply because the processing that we carry out is lawful and because all the personal data that we collect is necessary in order to achieve the purposes for which it is processed.

Right to data portability

We will accept data portability requests in specific cases relating to data communicated by customers, partners and prospective customers themselves, via our online services, and only where they fall under the purposes of consent and the performance of a contract. In such cases, the data will be provided to the person submitting the request in a structured, standard format that can be read by a machine.

Individual automated decision-making

We do not use any individual automated decision-making.
The tools on our website are provided solely to assist customers and prospective customers and shall not be construed otherwise.

Post-mortem rights

Customers, partners and prospective customers are informed that they have the right to issue directives concerning how their data should be retained, deleted and communicated after their death.

How to exercise your rights

To exercise your rights as laid out above, please contact, by email or by post, as you prefer:

Me Eric BARBRY
Cabinet Racine
40, rue de Courcelles
75008 PARIS – FRANCE
Email : dpo-adtalsace@racine.eu

7- Additional provisions

Optional and required responses

When personal data collection forms are presented to customers, partners and prospective customers, asterisks are used to indicate which responses are required and which are optional. Where responses are required, we explain the consequences of not providing them.

Usage rights

Customers, partners and prospective customers give our organisation the right to use and process their personal data for the purposes laid out above.
However, data that we create through processing and analysing operations, also known as enriched data, remains our exclusive property (usage analysis, statistics, etc.).

Processors

Please be aware that we may involve any processor of our choice in processing your data. In such cases, we will ensure that the processor complies with their obligations under the GDPR.
We undertake to sign a written contract with all our data processors and hold them to the same data protection obligations to which we ourselves are subject. In addition, we reserve the right to audit our processors to ensure that they are complying with the provisions of the GDPR.

Cross-border data flows

We reserve the right to decide independently whether to allow the personal data we process to flow across borders.
If we transfer your personal data outside the European Union or to an international organisation, we will make you aware of this and ensure that your rights are fully respected. If necessary, we undertake to sign one or more agreements to govern cross-border data flows.
We are bound by the provisions relating to cross-border data flows, except where the derogations laid down in article 49 of the GDPR apply.

Data processing register

As the data controller, we undertake to keep an up-to-date register of data processing activities, where the law requires us to do so.
This register takes the form of a document or application listing all the processing that we as the data processor carry out.
We undertake to provide the supervisory authority, on demand, with the information it needs to ensure that the processing has been carried out in accordance with the current data privacy legislation.

8- Security

Data security measures

We are responsible for defining and implementing the technical security measures, physical or logical, that we consider appropriate to guard against the destruction, loss, alteration or unauthorised disclosure of data, whether accidental or illicit.
To this end, we may seek the assistance of any third party of our choice to carry out, as often as we deem necessary, vulnerability audits and penetration tests.
We undertake, in any situation where we change the measures used to protect the security and confidentiality of personal data, to replace them with measures offering a superior level of performance. No upgrade will be allowed to lead to a reduction in the level of security.
If we entrust all or part of our personal data processing to data processors, we undertake to specify in our agreements with these processors security guarantees in the form of technical protection measures for the data, as well as the necessary human resources.

Data protection breaches

Should a data protection breach occur, we undertake to notify the CNIL (French data protection agency) under the conditions set out in the GDPR.
If the breach involves a high risk for our customers, partners and prospective customers and their data has not been protected, we will notify the data subjects and provide them with the necessary information and recommendations.

9- Contacts

Data protection officer

We have appointed a data protection officer. His name is Eric Barbry of Cabinet Racine (a law firm) at 40 rue de Courcelles, 75008 Paris, France – Email: dpo-adtalsace@racine.eu

We will contact our data protection officer before adding any additional form of data processing.
If you wish to obtain any particular information or ask a specific question, you can contact our data protection officer who will provide you with an answer within a period of time that is reasonable considering the question asked or information requested.
If you experience any kind of problem as regards the processing of your data, you can again contact our appointed data protection officer.

Right to lodge a complaint with the CNIL

Please be aware that as a customer, partner or prospective customer whose personal data is processed, if you judge that the way your data has been processed is not compliant with the European data protection regulations, you have the right to lodge a complaint with the supervisory authority (CNIL), at the following address:

Cnil – Service des plaintes
3 Place de Fontenoy- TSA 80715
75334 PARIS CEDEX 07
FRANCE
Tel : 00 33 (0)1 53 73 22 22

Changes to the policy

This policy may be amended or adjusted at any time in the event of a change to the law, case law, CNIL recommendations and decisions, or common practices.
We will make customers, partners and prospective customers aware of any new version of the policy by any method of our choosing, which may be an electronic method (distribution by email or online, for example).

Further information

Should you require any further information, please contact the DPO at the address given above: Eric Barbry, Cabinet Racine, 40 rue de Courcelles, 75008 Paris, France – Email: dpo-adtalsace@racine.eu
For any other more general information about data protection, please visit the CNIL website: www.cnil.fr