• TO & Travel Agents
  • Medias
mentions-legales.jpg
  1. Home
  2. Privacy policy

Privacy policy

CRT Privacy  and Personal Data Protection Policy

Published on 28 January 2022

This document lays out the principles and our commitment to the protection of your Personal Data and aims at informing you on:

  • The Personal Data collected by the CRT and the reasons behind this collection,
  • How these Personal Data will be used,
  • Your rights as a person with regards to our data processing.

This Policy applies to all the departments of the CRT whatever their nature (site, applications, services, etc.)

THE PERSON IN CHARGE OF YOUR DATA

The personal data controller is the CRT. The contact details are:

  • Address: Comité Régional de Tourisme Provence-Alpes-Côte d’Azur – 62/64 La Canebière – Immeuble Le Noailles – CS 10009 – 13231 Marseille cedex 01
  • Telephone no: +33 (0)4 91 56 47 00
  • Email: information@provence-alpes-cotedazur.com

HOW THE CRT IMPLEMENTS PERSONAL DATA PROTECTION

The CRT undertakes to take into consideration the protection of your Personal Data and your privacy from the moment the services offered are designed (Privacy by design). To guarantee security and the respect and proper exercise of your rights, measures enabling the protection of your Personal Data are implemented (Privacy by default).

WHICH PERSONAL DATA ARE USED BY THE CRT?

The CRT undertakes to collect only the data which are strictly necessary for the performance of the services offered.

In the case where you may be asked for optional data, the CRT will inform you clearly of the Personal Data needed to perform the service.

The Personal Data which are collected directly from you are only utilized for uses that you have been made aware of.

In the case where they have not been collected from you, the CRT will inform you as soon as possible of the processing for which they have been collected and its purposes.

The Personal Data are used to offer you further services solely if you have agreed to receive commercial communications.

WHAT IS THE FOUNDATION OF THE LEGITIMACY OF OUR PROCESSING?

The CRT uses the following legitimate bases to be able to process Personal Data:

Performance of Contract

The legal basis for the processing of the user’s Personal Data collected is the performance of the contract. In this regard, the user is obliged to provide the data needed for its performance. If they do not provide these data to the online payment service provider it will not be possible to perform the sale.

Consent

Concerning the following purposes, the legal basis for the processing of the user’s Personal Data shall be the user’s consent, in the case where they have granted it:

  • Management of registration on the site and its applications.
  • Management of the sending of information on tourism in PACA and personalised information adapted to the user’s profile.
  • Response to the exercise of rights and the user’s questions and complaints.
  • Management of tourist consumption and activities.

Withdrawal of consent of these processings by the user will not condition the performance of the contracts signed by the person concerned with the CRT.

Legitimate interest

For the following purposes, the legal basis for the processing of the user’s Personal Data shall be the legitimate interest of the CRT:

  • The establishment of profiles using site browsing by a user registered on the site, and also the users who have communicated their data for any other purpose.
  • The establishment of profiles for sending information about exclusive promotions, the latest novelties and personalised information adapted to the user’s profile.
  • Sending satisfaction surveys about products purchased or services used by the CRT’s customers to request their opinion and improve them.
  • The dissemination of tourist information on the region including commercial information.

Our legitimate interest consists of being able to guarantee that our site remains secure, and being able to help the CRT to understand the needs, expectations and users’ level of satisfaction, to improve the services, products and brands. All these actions are performed to improve the customer’s level of satisfaction and guarantee a unique navigation and purchasing experience.

PERSONAL DATA OF MINORS?

Some services can be used by minors aged under fifteen. In this case, the minors must obtain consent from their parents or legal representatives.

TO WHOM CAN YOUR PERSONAL DATA BE COMMUNICATED?

Your data may be transmitted:

  • To CRT internal services: the divisions in charge of performing the subscribed services, in particular Customer Service, Sales Administration…
  • To CRT external service providers: technical service providers, including subcontractors;
  • To CRT partners, after having informed you beforehand and allowed you to express your choices using a checkbox.

CAN YOUR PERSONAL DATA BE TRANSFERRED OUTSIDE THE EUROPEAN UNION?

The CRT carries out all the processing of your Personal Data on the territory of the European Union (EU).

However, for some specific services, the CRT may call upon sub-contractors established outside the EU. Certain Personal Data may then be communicated for the strict needs of their missions. In this case, following the regulations in force, the CRT demands of its sub-contractors that they provide the guarantees required for the supervision and securing of these transfers, in particular through the signature of standard contractual clauses of the European Commission.

HOW LONG DOES THE CRT KEEP YOUR PERSONAL DATA FOR?

The length of time for which your Personal Data are kept depends on the services you have subscribed to. The CRT undertakes not to keep your Personal Data beyond the length of time needed to supply the service, and therefore of your use of the service, increased to the retention period imposed by the rules applicable regarding legal directives.

ARE YOUR PERSONAL DATA PROTECTED?

The CRT undertakes to take all measures to ensure the security and privacy of the Personal Data and specifically to prevent them from being damaged, obliterated or access to them being gained by third-parties.

Moreover, in the case of a security incident affecting your Personal Data (destruction, loss, deterioration or disclosure), the CRT undertakes to respect the obligation to notify of breaches of Personal Data, particularly to the CNIL.

WHAT RIGHTS DO YOU HAVE TO YOUR PERSONAL DATA?

You are, at any time, entitled to exercise before the CRT the rights provided for by the regulations in force applicable to personal data, provided that you meet certain conditions:

  • Right of access: you may receive communication of your Personal Data referring to processing by the CRT;
  • Right of rectification: you may update your Personal Data or have your Personal Data processed by the CRT rectified;
  • Right of opposition, in particular, to receive commercial communications: you may express your wish to no longer receive commercial communications from the CRT or request that your Personal Data no longer be processed;
  • Right to erasure: you may request the removal of your Personal Data;
  • Right to restriction: you may request the suspension of the processing of your Personal Data;
  • Right to portability: you may request that the CRT return your Personal Data for your own purposes.

When you subscribe to a service or the collection of your Personal Data, an address (postal and/or electronic) is indicated where you can send your request to exercise your rights.

All requests must be accompanied by proof of identity. The CRT undertakes to answer your requests to exercise your rights without undue delay and in all events within strict legal deadlines.

HOW CAN YOU EXERCISE YOUR RIGHTS?

The appointment of a Data Protection Officer shows the CRT’s attachment to the protection, security and privacy of its customers’ Personal Data. You can contact the Data Protection Officer at the following address: le Délégué à la Protection des Données:

Nicolas Courtier – DPO du CRT Provence-Alpes-Côte d’Azur – 55 rue Paradis –  13006 Marseille or by email: dpo@provence-alpes-cotedazur.com

You also have the right to petition La Commission nationale de l’informatique et des libertés (CNIL), 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 (https://www.cnil.fr/) for any claim relative to the manner in which the CRT processes your Personal Data.

MODIFICATION OF THIS POLICY

Updates to this Policy concerning privacy will be published here: https://provence-alpes-cotedazur.com. We will also publish a notice on the CRT website, along with the updated Privacy Policy.

GLOSSARY

Each term beginning with a capital letter has the meaning that is given hereunder.

  • “Privacy and Personal Data Protection” and “Policy”: refers to this Policy which describes the measures taken for the processing, exploitation and management of your Personal Data and your rights as a person with regards to processing.
  • “Personal Data”: Refers to all the data relative to you and which makes it possible to identify you directly or indirectly.
  • “Processing”: Refers to any operation or set of operations applied to your Personal Data.
  • “Processing controller”: Refers to the CRT which carries out the processing of your Personal Data.
  • “Breach of Personal Data”: Refers to an accidental or illicit breach of security resulting in the destruction, loss, deterioration, disclosure or unauthorized access to your Personal Data.
  • “Addressee”: refers to the department or the company receiving communication which may access your Personal Data.

Close