This privacy policy describes how WhyTrek, Julien Callet, entrepreneur individuel (sole trader) under the micro-entreprise scheme, SIREN 982 057 218, collects and processes the personal data of users of the whytrek.fr website and of persons booking a service, in compliance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the loi Informatique et Libertés (French Data Protection Act).
Data controller
The data controller is WhyTrek, Julien Callet. For any question relating to your data, you can send a request through the contact form on the site.
Data collected and purposes
WhyTrek collects only the data necessary to manage enquiries and bookings:
- Surname, first name, email address and telephone number, submitted through the contact form on the site, the registration form or the dedicated WhatsApp community, in order to respond to enquiries and organise outings.
- Information about your plans (level, preferred dates, number of participants) that you choose to provide.
- Where applicable, a paper health information form, filled in by the participant and read by the guide before departure, solely for the safety of the guiding. It is handed back to the participant on the spot: WhyTrek keeps no copy.
- First name and email address, if you subscribe to the WhyTrek news email or download the GR20 ebook from the site, in order to receive the requested ebook, upcoming dates and WhyTrek news, at a pace of about one email a month.
Booking journey
Events are booked through the online booking form on the event page. Other enquiries go through the contact form on the site or the dedicated WhatsApp communities. The data submitted through these channels is used exclusively to manage your enquiry and to organise outings. Using WhatsApp means that these third-party services also process certain data under their own privacy policies.
Legal basis
The processing is based on your consent (contact enquiry), on the performance of pre-contractual measures and of the contract (organising the service booked) and on WhyTrek’s legitimate interest in ensuring the safety of outings.
Sending the news email is based on your consent, given by ticking a box and confirmed through a validation link sent to your address. You can withdraw it at any time.
Retention period
Contact data (surname, first name, telephone, email) is kept for as long as is necessary to handle the enquiry and the relationship, then deleted. Health information forms are not kept: they are handed back to the participant after reading.
Subscribers’ data is kept until they unsubscribe, and at the latest three years after their last active contact with WhyTrek (a click in an email, an enquiry, a booking). After unsubscribing, the address is kept on a suppression list, for the sole purpose of no longer writing to you.
Recipients
Your contact details (surname, first name, email, telephone) and the follow-up of your enquiry are recorded in a customer relationship management (CRM) tool used by WhyTrek to handle your enquiry, to follow it up and to contact you again. This data is intended for WhyTrek only: it is accessible to WhyTrek and to its technical service providers (hosting provider, form service, email service, CRM) strictly to the extent necessary for them to operate, is neither sold nor transferred to third parties for commercial purposes, and is kept for as long as is necessary for the relationship, then archived in accordance with the applicable regulations.
The booking form is protected against automated submissions by the Akismet service, provided by Automattic Inc. With each submission, the visitor’s name, email address and IP address are sent to that service, whose sole role is to determine whether the submission is spam. This processing is based on WhyTrek’s legitimate interest in protecting its form from automated submissions. As Automattic Inc. is established in the United States, this transfer takes place under that provider’s data processing agreement.
Online bookings are collected by the WPForms form on the site, published by Awesome Motive (United States), then recorded by a Google Apps Script in a private Google Sheets spreadsheet, accessible to WhyTrek only. Site traffic is measured by Google Analytics, after your consent. As Google and Awesome Motive may process data outside the European Union, these transfers take place under their data processing terms.
Emails sent by the site, including the news email and form notifications, go through the Brevo service, published by Sendinblue SAS (9-17 rue Salneuve, 75017 Paris, France, Paris Trade and Companies Register 498 019 298), which acts as WhyTrek’s processor. For the news email, your first name, your email address and the sending statistics (opens, clicks, unsubscribes) are stored in WhyTrek’s Brevo account and are used only for that purpose. Brevo publishes the list of its own sub-processors in its data processing agreement and states that any transfer of data outside the European Union is covered by appropriate safeguards.
Your rights
In accordance with the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability in respect of your data. You can exercise these rights through the contact form on the site. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).
Every news email includes an unsubscribe link, effective immediately.
Cookies
The site uses cookies that are strictly necessary for it to function, as well as audience measurement cookies (Google Analytics, provided by Google) to analyse traffic and improve the site. The latter are placed only after your consent, which you can withdraw at any time, and are kept for a limited period and then deleted. With your consent, the site also uses the Meta (Facebook) pixel and the LinkedIn Insight tag, to measure the effectiveness of its posts and campaigns on these networks; Meta and LinkedIn process this data under their own privacy policies. For full details of the cookies used and to manage your preferences, see the cookie policy.
Security
WhyTrek implements reasonable measures to protect data against any unauthorised access, alteration or disclosure. The site is accessible over HTTPS.