The term “you” refers to you but also, as far as relevant, to any other person mentioned in your booking or application; please ensure that they have read and understood this policy before entrusting us with their data.
Personal data processed by GraffitiART and purposes
The personal data that we process are data that you provide to us, data that refer to behaviors that we observe. Below are the cases that can happen.
- Personal data such as name, first name, address, e-mail address, company name and telephone number will be requested in case of an information request or to prepare a quotation. This information is necessary to provide you with the information or service you requested. The legal basis for the processing is the performance of a contract to which the data subject is party or the performance of pre-contractual measures taken at the request of the data subject;
- Your name and contact information will also be collected if you participate in a promotion, fill out a form to report a problem with one of our Services. The legal basis for the processing is the performance of a contract to which the data subject is party or the performance of pre-contractual measures taken at the request of the data subject;
- If you contact us, we will record your contact information, including your e-mail address. The legal basis for the processing is the performance of a contract to which the data subject is party or the performance of pre-contractual measures taken at the request of the data subject
- Details of the services you have received, including past services, and information relating to such terms and conditions, such as your specific requests and complaints. The legal basis is the pursuit of a legitimate interest of the responsible party in improving the customer experience;
- Information about your visits to our Sites is routinely collected (including, but not limited to, traffic data, your location and connection data to our Site), whether necessary for our business or otherwise, as well as information about the resources you access. We use independent services such as Google Analytics to manage these services. The legal basis for the processing is consent;
- We collect information about the website(s) visited prior to using a link to our Sites, the pages visited on our Sites and the time spent on each page. We may collect data about your computer (or mobile/tablet device) including, where applicable, your anonymized IP address, operating system, device location, browser type, and cookie ID numbers for system administration or marketing purposes (for us and for third party advertisers to whom we provide advertising services) and to report aggregate information to our advertisers. This is statistical data about our users’ browsing activities and patterns and no reports are made about their identity. The legal basis for the processing is consent;
If the data collected is intended for processing whose legal basis is the performance of a contract to which the data subject is a party or the performance of pre-contractual measures taken at the request of the data subject, any refusal may make it impossible to achieve the above-mentioned purposes. The collection of data for processing whose legal basis is consent is not mandatory and any refusal may prevent the provision of certain services. You may revoke your previously given consent at any time. Such revocation shall not render the processing previously carried out on the basis of the consent given unlawful.
Data transfer and third party access
When you provide us with personal data, some of it will be communicated to, processed and stored by third parties: our technology partners, subcontractors as defined by the regulation, who help us provide our Services. Some of these third parties may be based outside the European Economic Area (EEA) and your data will only be transferred to third parties based outside the EEA if the transfer is necessary to perform your contract. Unless you object, we may disclose your personal information to any member of our group (including for the purpose of storing your data on central/shared systems for the purpose of managing bookings and accompanying customers to destination countries). Our group includes our subsidiaries, our parent company and its subsidiaries. We may share your data with suppliers in order to detect and prevent fraudulent payments.
If you have made a request or a purchase on our Site, or from our company, your personal data may be used within the limits provided for by law, to contact you by post, by electronic means (e-mail or SMS) and/or by telephone in order to provide you with information and personalized offers concerning the products or services that you can purchase/book from us. You will only receive this information if you did not object at the time we collected your information or sent you the information. If you have not made a request or purchase, we will only send you information and offers by email or SMS if you have requested to receive such communication, either from us or from a third party. Except with your express consent, we will not share your contact information with third parties outside of our suppliers involved in providing the services and products, so that they may contact you or send you marketing communications. You can ask us at any time not to use your personal data for marketing purposes. You can exercise your right to prevent this treatment by selecting the option left to you to oppose any commercial solicitation on the media we use to collect your data. You may also exercise this right at any later time by using the unsubscribe link on any marketing email you receive by following the unsubscribe instructions, by following the unsubscribe instructions on any marketing communications sent by post or by sending an unsubscribe request to the following postal address: GraffitiART c/o AboMarque CS 60003 – 31242 L’Union Cedex FRANCE or to the following email address: firstname.lastname@example.org.
When you make a reservation or any other purchase from our company, your personal data is kept in order to provide you with the best possible customer service. We also retain your personal data to meet our legal and audit obligations but only for as long as necessary and in accordance with any retention period required by law. Our primary retention periods are as follows: – Marketing consent preferences are kept for a maximum of 3 years from the date of consent; – Contracts are kept for a maximum of 5 years from the date of arrival of the last trip of the reservation; – Invoices are kept for a maximum of 10 years from the end of the accounting period; – Contest/prize draw data is kept for a maximum of 3 years from the date of expiry of the contest; – “Cookie” data is kept for a maximum of 13 months from the moment the cookie is set; – Complaints and claims are kept for a maximum of 5 years from the date of the complaint; – Documents relating to legal claims are kept for a maximum of 5 years from the date of settlement of the dispute.
Rights of the persons concerned
We inform you that you can exercise your rights under art. 12 of the Rules, by writing to GraffitiART c/o AboMarque CS 60003 – 31242 L’Union Cedex FRANCE. You can ask to know the origin of the data as well as the logic and the purpose of the treatment; obtain the cancellation, the transformation in anonymous form or the blocking of the treatment of the data carried out in violation of the law, as well as the updating, the correction or, if it is in your interest, the integration of the data; if necessary you can obtain the limitation of the treatment as well as oppose, for legitimate reasons, to the treatment. The right to withdraw consent at any time without prejudice to the lawfulness of the processing on the basis of the consent given prior to the revocation is guaranteed. The right to data portability is guaranteed, as well as the right to lodge a complaint with the CNIL if you feel that the use of your personal data does not comply with data protection regulations.