Privacy Policy

1 Introduction

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when you use the service, and tells you about your privacy rights and how the law protects you.

We use your personal data to provide and improve the service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2 Interpretation and definitions

Interpretation

Words with an initial capital letter have meanings defined under the following conditions. The following definitions have the same meaning regardless of whether they appear in singular or plural form.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access our service or parts of our service.
• The Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Avygeo SAS, 131 Boulevard Pereire, 75017 Paris, France.
• Cookies are small files that are placed on your computer, mobile device or any other device by a website, containing details of your browsing history on that website among its many uses.
• Country refers to: France.
• Device means any device that can access the Service such as a computer, mobile phone or digital tablet.
• Personal data is any information that relates to an identified or identifiable individual.
• Service refers to the website.
• Service provider means any natural or legal person who processes the data on behalf of the Company.
• Third-party social media service means any website or social network site through which a User can log in or create an account to use the Service.
• Usage data refers to data collected automatically, either generated by the use of the service or from the service infrastructure itself (for example, the duration of a page visit).
• Website refers to Avygeo, accessible at https://www.avygeo.com/en/
• You means the individual accessing or using the Service, or the company or any other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

3 Collection and types of data

Personal data

When using our service, we may collect the following categories of personal data:

• Identification data: first name, last name, username, email address, profile picture
• Connection data: IP address, session identifier, connection logs
• Published content: reviews, ratings, photos, articles, comments
• Browsing data: pages visited, visit duration, browser type, operating system, device used
• Data from third parties: in case of login via Google or Facebook, the information associated with your account (name, email, profile picture)

Usage data

Usage Data is collected automatically when using the Service through a third-party tool, Google Analytics.

Usage data may include information such as your device's Internet protocol address (e.g. IP address), browser type, browser version, the pages of our service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you access the service by or through a mobile device, we may automatically collect certain information, including but not limited to the type of mobile device you use, the unique ID of your mobile device, the IP address of your mobile device, your operating system, the type of mobile internet browser you use, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends every time you visit our service or when you access the service by or through a mobile device.

4 Third-party social networks

The Company lets you create an account and sign in to use the Service through Facebook and Google.

If you choose to register on Avygeo via your Facebook or Google account, we may collect personal data already associated with your account, such as your name, email address, profile picture, activities or contact list.

You may also have the option to share additional information with the Company through your account. If you choose to provide such information and personal data, during registration or otherwise, you authorise the company to use, share and store it in a manner consistent with this Privacy Policy.

5 Tracking technologies and cookies

We use cookies and similar tracking technologies to track activity on our service and store certain information. The tracking technologies used include beacons and scripts to collect and track information and to improve and analyse Our Service. The technologies we use may include:

• Cookies or browser cookies. A cookie is a small file placed on your device. You can ask your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our service. Unless you have set your browser to refuse cookies, our service may use cookies.
• Web beacons. Some sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that allow the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics.

Cookies may be "persistent" or "session" cookies. Persistent cookies remain on your personal computer or mobile device when you log off, while session cookies are deleted as soon as you close your web browser.

We use both session and persistent cookies for the purposes described below:

• Necessary / essential cookies — Type: session — Administered by: Us — These Cookies are essential to provide you with the services available on the Website and to enable you to use some of its features. They help authenticate users and prevent fraudulent use of user accounts.
• Acceptance cookies — Type: persistent — Administered by: Us — These cookies identify whether users have accepted the use of cookies on the website.
• Functionality cookies — Type: persistent — Administered by: Us — These cookies allow us to remember the choices you make when using the website, such as remembering your login details.
• Analytics cookies — Type: persistent — Administered by: Google Analytics — Analytics cookies set by Google Analytics allow us to better understand our sites and apps and improve our services by producing usage statistics and traffic volumes (sections and content visited, journeys, etc.).
• Advertising cookies — Type: persistent — Administered by: Google Ads and its business partners — These are the cookies used to display ads or to deliver information tailored to your interests. Refusing these cookies has no impact on the use of our sites and will not stop advertising, but ads will not take your interests into account.

6 Accepting or refusing cookies

You have several ways to manage cookies.

Browser settings

You can disable these cookies at any time. Your browser can also be configured to notify you when cookies are placed on your computer and ask whether to accept them. You may accept or refuse cookies on a case-by-case basis, or refuse them altogether once and for all.

Please note that your settings may change the conditions under which you access our services that rely on cookies.

If your browser is configured to refuse all cookies, you will not be able to log in, publish content, access your private inbox, track the donations you generate, etc. To manage cookies as closely as possible to your preferences, we invite you to configure your browser according to the purposes of cookies as described above.

The configuration of each browser is different. It is described in your browser's help menu:

• Chrome
• Firefox
• Safari
• Internet Explorer / Edge
• Opera

Cookie management platforms

You can manage your cookies via cookie management platforms provided by advertising professionals.

More information about cookies on the CNIL website (French data protection authority).

7 Use of your personal data

The Company may use Personal Data for the following purposes. In accordance with the GDPR (article 6), each processing operation relies on a specific legal basis:

• Provide and maintain the Service — including monitoring usage of our Service.
  Legal basis: performance of the contract (art. 6.1.b)
• Manage Your Account — manage Your registration as a user of the Service. The Personal Data You provide may give you access to different functionalities of the Service.
  Legal basis: performance of the contract (art. 6.1.b)
• Enforce the rules — use of Our Service is subject to Terms of Use. You remain the owner of and responsible for the content you publish on Avygeo.
  Legal basis: legitimate interest (art. 6.1.f), security and integrity of the Service
• Contact You — by email or other electronic communication regarding updates or informative communications about contracted features, products or services, including security updates.
  Legal basis: legitimate interest (art. 6.1.f), informing users
• Provide news and offers — general information about other goods, services and events, if you have requested to receive this type of information.
  Legal basis: consent (art. 6.1.a)
• Handle Your requests — assist with and process the requests you send us.
  Legal basis: performance of the contract (art. 6.1.b)
• Audience measurement and Service improvement — data analysis, identification of usage trends, evaluation of the effectiveness of our communication campaigns.
  Legal basis: legitimate interest (art. 6.1.f), Service improvement
• Personalised advertising — display of ads tailored to your interests via Google Ads and its partners.
  Legal basis: consent (art. 6.1.a), collected via the cookie banner

8 Data retention

The Company only retains your personal data for as long as necessary for the purposes for which it was collected. The applicable retention periods are as follows:

• Account data (name, email, profile): lifetime of the account + 3 years after deletion or last activity (civil prescription)
• Published content (reviews, photos, articles): lifetime of the account. After account deletion, the content is anonymised or removed at your request
• IP addresses and connection logs: 12 months (in accordance with the French LCEN law and CNIL recommendations)
• Browsing and analytics data: 14 months maximum (CNIL recommendation for Google Analytics)
• Quote request data: 3 years after the last contact with the partner
• Session cookies: deleted when the browser is closed
• Persistent cookies: 13 months maximum

Beyond these periods, your data is irreversibly deleted or anonymised. We may retain certain data longer when the law requires it (tax obligations, ongoing litigation).

9 Disclosure of your data

Company changes

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

Law enforcement

In certain circumstances, the Company may be required to disclose your personal data if required to do so by law or in response to valid requests from public authorities (e.g. a court or government body).

Other legal requirements

The Company may disclose your personal data in the good-faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Service Users or the public
• Protect you from legal liability

10 Subprocessors and recipients

Your personal data may be processed by the following subprocessors, strictly within the purposes described above:

• OVH SAS (Roubaix, France): server and data hosting
• Cloudflare, Inc. (San Francisco, USA): content delivery network (CDN), attack protection, performance optimisation
• Google LLC (Mountain View, USA): audience measurement (Google Analytics), advertising (Google Ads), login via Google SSO
• Meta Platforms, Inc. (Menlo Park, USA): login via Facebook

These subprocessors contractually commit to processing your data in accordance with our instructions and the GDPR. No other third party has access to your data, except where required by law.

11 Data transfers outside the European Union

Some of our subprocessors (Cloudflare, Google, Meta) are established in the United States. These transfers are governed by:

• The EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) for certified entities
• Standard Contractual Clauses (SCCs) approved by the European Commission, where the Data Privacy Framework does not apply

Your data hosted with OVH stays on servers located in France.

12 Security of your data

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

13 Your rights

In accordance with the General Data Protection Regulation (GDPR) and the amended French Data Protection Act, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy
• Right to rectification: request the correction of inaccurate or incomplete data
• Right to erasure: request the deletion of your data in cases provided for by law
• Right to restriction: request the suspension of processing of your data
• Right to object: object to the processing of your data on legitimate grounds
• Right to portability: receive your data in a structured, commonly used format

You can exercise these rights by editing or deleting your profile online, or by contacting us at .

You also have the right to lodge a complaint with the CNIL (the French data protection authority).

14 Privacy of minors

Our service is not directed at anyone under the age of 15 (in accordance with article 7-1 of the French Data Protection Act, which sets digital consent in France at 15 years old). We do not knowingly collect personally identifiable information from anyone under 15. If you are a parent or guardian and you know that your child has provided us with personal data, please contact us. If we learn that we have collected personal data from anyone under 15 without verification of parental consent, we take steps to remove that information from our servers.

If we need to rely on consent as the legal basis for processing your information and your country requires the consent of a parent, we may require your parent's consent before collecting and using that information.

15 Links to other websites

Our service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party site or service.

16 Processing of custom-trip quote requests

When you fill out the quote request form for a custom trip (for example a custom tour of Peru), we collect certain personal information:

• Your first name and last name
• Your email address
• Your phone number
• Details about the type of trip you want

This data is used only to forward your request to our local partner, an agency specialised in organising custom trips. This transmission is necessary so that the agency can get back to you and propose a personalised offer, in line with your request.

The legal basis for this processing is your consent, which you give by filling out and sending the form (in accordance with article 6.1.a of the GDPR).

Our partner commits to comply with the applicable regulations on personal data protection and to use your information only in the context of your quote request. No other commercial use or transfer to third parties is performed.

In accordance with the law, you can at any time exercise your rights of access, rectification, erasure, restriction, objection and portability of your data. To do so, simply write to us at: .

17 Changes to this policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will notify you by email and/or a prominent notice on Our Service before the change takes effect, and we will update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

18 Contact us

If you have any questions about this Privacy Policy, you can contact us by email at .