Privacy policy
This policy explains how Maison Voyage collects and uses your personal data when you visit this website, book a tour or contact us, in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).
1. Who is responsible
Salomé Dzvelaia (Maison Voyage), 4 rue Caulaincourt, 75018 Paris, France, SIRET 131 003 972 00018. Privacy contact: booking@maisonvoyage.fr.
We have not appointed a Data Protection Officer: the GDPR does not require one for a business of our size and activity.
2. What we collect, why, and on what legal basis
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Managing your booking: email verification, confirmation, contacting you about the tour, delivering the tour | Name, email, telephone (optional), tour, date, time, number of participants, tour language, anything you tell us voluntarily | Performance of a contract — art. 6(1)(b) | 3 years after your last tour, then anonymised |
| Taking your payment | Name, amount, payment reference | Performance of a contract — art. 6(1)(b); accounting obligations — art. 6(1)(c) | 10 years (accounting records) |
| Health information you choose to share (allergies, reduced mobility) | Only what you write in your request | Your explicit consent, given by providing it — art. 9(2)(a); you can withdraw it at any time by asking us to delete it | Deleted with the booking’s personal data |
| Unconfirmed reservation attempts (email never verified) | Same as above | Pre-contractual steps — art. 6(1)(b) | 30 days, then anonymised |
| Accounting and proof of the contract | Reference, tour, date, guests, price, version of the terms accepted — no name or contact details | Legal obligation — art. 6(1)(c) (French Commercial Code art. L123-22) | 10 years |
| Answering your messages | Name, email, message | Pre-contractual steps at your request — art. 6(1)(b), or our legitimate interest in answering — art. 6(1)(f) | 1 year |
| Website security: preventing fraud, automated attacks and brute force | Truncated IP address and a keyed hash of it, page, type of event — only when a request is blocked or suspicious | Legitimate interest in securing the service and your data — art. 6(1)(f) and art. 32 | 6 months |
| Operating the hosting: technical request logs | IP address, date, page requested, browser type — recorded by our hosting provider for every request | Legitimate interest in operating and securing the service — art. 6(1)(f) | 30 days |
| Proof that service emails were sent | Masked email address, type of email, date, delivery status — never the content or codes | Legitimate interest — art. 6(1)(f) | 1 year |
| Handling your data protection requests | Type of request, dates, masked email address | Legal obligation — art. 6(1)(c) and art. 5(2) | 3 years |
Name and email are required to book: without them we cannot confirm or deliver the tour. Everything else is optional. Please do not include health or other sensitive information in special requests unless it is needed for the tour (for example a food allergy on a food tour); if you do, it is used only for that purpose.
We do not take card payments on this website, do not use analytics, advertising or social-media trackers, do not sell your data, do not send marketing emails and do not make automated decisions about you.
3. Who receives your data
Your data is accessible only to Maison Voyage staff who need it (guide, booking manager), each with a personal account protected by a password and a second authentication factor. The following service providers process data on our behalf under a data processing agreement (GDPR art. 28):
- Hosting and database: Google Cloud EMEA Ltd — Cloud Run & Cloud SQL, region europe-west9 (Paris, France)
- Email delivery: [to be completed]
- Payment: the bank or payment provider you use to pay us, as an independent controller for the payment itself
Your data is stored in the European Union. Our hosting provider belongs to a group based in the United States; any access from outside the EU would be covered by the EU–US Data Privacy Framework adequacy decision and the European Commission’s Standard Contractual Clauses (GDPR chapter V). Personal data in our database is additionally encrypted with a key that we control.
If you book through a platform such as Viator or Tripadvisor, that platform is a separate controller and its own privacy policy applies to the data you give it.
4. Security
We apply technical and organisational measures appropriate to the risk (GDPR art. 32): encrypted connections (HTTPS), encryption of personal data in the database (AES-256), verification codes stored only as irreversible hashes, rate limiting and brute-force protection, staff accounts with two-factor authentication and role-based permissions, a tamper-evident log of every administrative action, daily backups kept 14 days, and automatic deletion of data that is no longer needed. Fonts and all other resources are served from our own domain, so your browser does not contact third parties when you visit.
If a personal data breach is likely to put you at risk, we notify the CNIL within 72 hours and inform you without undue delay (GDPR art. 33–34).
5. Your rights
You can access your data, have it corrected or erased, restrict or object to its processing, and receive it in a portable format (GDPR art. 15–21). You can also give instructions on what happens to your data after your death (Loi Informatique et Libertés art. 85).
- Online, immediately: My bookings — verify your email, then download your data, correct your details or delete your data. Deleting cancels any upcoming booking and anonymises past ones.
- By email: booking@maisonvoyage.fr. We reply within one month and may ask you to confirm the request from the email address used for your booking.
You can lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr), or with the authority of your EU country of residence.
6. Cookies
We only use strictly necessary cookies, which do not require consent. Details in our cookie policy.
7. Changes
We publish any change on this page with a new date. Significant changes affecting existing bookings are communicated by email.
Last updated: 31 October 2026