PARIS CITY VISION PRIVACY POLICY

In force as of January 2020

PARIS CITY VISION considers the protection of personal data to be essential and wishes to clearly and transparently explain how and why it collects, processes, stores and uses User personal data. 

This privacy policy also sets forth User rights and monitoring tools with respect to the treatment of their personal data.  
 
This privacy policy (hereinafter the “Privacy Policy”) is proposed by CITYVISION, a société par actions simplifiée (hereinafter the “Company”), having its registered office at 194, rue de Rivoli 75001 Paris, registered with the Paris Trade & Companies Register under No. 421 197 005 and with the intra-community VAT number FR60 421 197 005.
The Company’s telephone number is +33 (0)1 44 55 60 00 and its email address is [email protected]

The director of the publication is Karl Gremillet.

The Company publishes the website asterix.pariscityvision.com (hereinafter the “Website”) which it makes available to the users (hereinafter the “Users”). 

The Website is hosted by ANIL INFORMATION SYSTEMS.
 
The Company provides Website Users with tourist services, in particular excursions, trips, visits, leisure activities and dining and cultural discovery activities (hereinafter the “Services”). In order to perform these Services, the Company is registered with the Atout France register under No. IM075120024 and benefits from a financial guarantee with the APST (15, avenue Carnot, 75017 Paris) and third-party liability insurance with MMA ENTREPRISE, (19-21 avenue de L’Europe 92210 Clichy).

What information does the Company collect from its Users?  

To allow Users to order Services on the Website and contact the Company, the Company, acting as data controller, has to collect personal data regarding Users, in particular:
-    Full name; 
-    Email address;
-    Home address; 
-    Location of the hotel;
-    Additional addresses (billing as may be relevant); (optional)
-    Landline and mobile telephone number; (optional)
-    The language chosen for the Services (optional)

The User is informed that if he does not wish to provide the personal data requested, the Company will be unable to fulfill the order.

Children’s personal data on our Website 

THE WEBSITE CAN ONLY BE USED BY PERSONS AGED EIGHTEEN AND OVER.  

How and for what purpose is User personal data used?  
 
The Company uses User personal data for the following purposes: 

Purpose	Legal basis of processing
Provision of Services on the Website	Processing is necessary for the performance of the agreement entered into with the User
Acceptance of orders	Processing is necessary for the performance of the agreement entered into with the User
Management and processing of orders	Processing is necessary for the performance of the agreement entered into with the User
Billing	Processing is necessary for the performance of the agreement entered into with the User
Information about the Company, the Services and the Company’s activities	Processing is necessary for the purpose of the Company’s legitimate interests
Response to any User questions/complaints	Processing is necessary for the performance of the agreement entered into with the User
Establishment of commercial statistics	Processing is necessary for the purpose of the Company’s legitimate interests
Commercial prospection	Processing is based on the User’s consent
Management of requests regarding the rights to access, portability, erasure, restricted processing, rectification and objection	Processing is necessary for the performance of the agreement entered into with the User
Management of unpaid amounts and litigation	Processing is necessary for the performance of the agreement entered into with the User

 
With which third parties does the Company share User personal data? 

User personal data is processed by the Company and subcontractors which assist the Company with its activity, i.e. tour operators and the Website host ANIL INFORMATION SYSTEMS. The servers on which User personal data is stored are situated in France. The Company does not transfer User personal data internationally.  

The Company may also communicate personal data in order to cooperate with administrative and legal authorities.

What rights does the User have? 

Users benefit from a number of rights, as listed hereafter: 
•    Right to access: the right to be informed and to request access to personal data that the Company is processing; 
•    Right to rectification: the right to ask the Company to modify or update your personal data if it is inaccurate or incomplete; 
•    Right to erasure: the right to ask the Company to permanently erase your personal data; 
•    Right to restriction: the right to ask the Company to temporarily or permanently stop the processing of part or all of your personal data; 
•    Right to object: 
o    the right to refuse the processing of your personal data at any time; 
o    the right to refuse processing of your personal data for marketing purposes; 

•    Right to withdraw consent: the right to withdraw consent for the processing of personal data, at any time, by a simple measure equivalent to that used to obtain the User’s consent; 
•    Right to data portability: the right to request a copy of your personal data in electronic format and the right to communicate such personal data for use by a third-party service; 
•    Right to give postmortem instructions: the User can give the Company instructions regarding the storage, erasure and communication of his personal data after his death. In the absence of such instructions, the Company will grant the requests of the successors as restrictively set forth in Article 40-1, III of the French Data Protection Act.
   
How can the User exercise his rights?  

In order to exercise the rights set forth above and for any questions regarding the processing of personal data, the User can contact the Company at the following email address: [email protected] or by telephone via the following number: +33 (0)1 44 55 60 00 or by post to the following address: CITYVISION – Data Protection Officer, 194 rue de Rivoli, 75001 PARIS FRANCE. 

To allow the Company to process the request as quickly as possible, the User can indicate in his request the purpose and context in which his personal data was collected by the Company.
 
How does the Company secure User personal data? 

The Company seeks to secure User personal data by taking the appropriate technical and organizational measures to guarantee a level of security adapted to the risk, such as pseudonymization and encryption of User personal data, any means which can guarantee the permanent privacy, integrity, availability and resilience of systems and processing services, any means allowing availability and access to personal data to be restored, and a procedure seeking to test, analyze and regularly assess the efficacy of technical and organizational measures in place.

How long is User personal data stored? 

User personal data is stored only for the time necessary to achieve the purpose for which the Company stored this data, in order to meet User needs and fulfill legal obligations.

In order to establish the storage period of personal data, the Company applies the following criteria:

-    in the event of orders for Services, personal data is stored for the term of the contractual relation and for the legally required periods;
-    User personal data collected can also be used for commercial prospection purposes and is stored for three years after collection or last contact with the User;
-    if the User makes a request to the Company, personal data will be stored for the period necessary for the processing of the request;
-    if cookies are placed on the User’s device, the personal data is retained for the duration of the session identification cookies and for any period as defined in accordance with applicable regulations; the maximum retention period of cookies is 13 months from the date when they are first placed on the User's device, the same applying to the period of validity of the User’s consent to the use of such cookies. The lifetime of the cookies is not extended by subsequent visits. The User’s consent will therefore need to be renewed upon expiry of this period.
-    Banking data (if applicable) is stored for a maximum period of 13 months;

At the end of the above-mentioned periods, the personal data will be erased or the Company will anonymize said data. 

Links to third-party websites on the Company Website 

In order to improve the quality of our services, the Company may, at any time, include links to third-party websites. These sites have a different and independent privacy policy to the Company. The User is invited to consult the privacy policy of third-party websites it visits. 

The User’s right to file a claim with the French Data Protection Authority (CNIL)  

In the event of a claim, Users can contact the French Data Protection Authority, the competent authority regarding personal data. Its contact details are as follows: 3 Place des Vosges, 75007 Paris, telephone No.: +33 (0)1 53 73 22 22.
 
What cookies/trackers are used by the Company on the Website and how can you object? 
 

Within the context of browsing or creating an account on the Website, the Company uses the following trackers:

Name	Usefulness	Expiry
FO_PRODUCT_HISTORIC	History of products visited => Makes it possible to display products visited by the customer	6 months
PAPVisitorId	PAP username (affiliation) => Makes it possible to know if the customer comes from an affiliate	13 months
SESSION	User session => Makes it possible to store the user’s session data (E.g. Basket)	2 hours
MUID	Bing username => Makes it possible to convert users from a Bing advertisement	13 months
Fr	Facebook session username => Makes it possible to convert users coming from a Facebook advertisement	3 months
_fbp	Unique Facebook username => Makes it possible to convert users coming from a Facebook advertisement	3 months
_ga	Unique Google Analytics username => Makes it possible to collect statistics for Google Analytics	13 months
_gcl_au	Google Adsense => Makes it possible to convert users coming from a Google Adsense advertisement	3 months
_gid	Google session username => Makes it possible to collect Google Analytics statistics	1 day
ad-id	Amazon => Makes it possible to convert users coming from an Amazon advertisement	1 January following year
ad-privacy	Amazon => Makes it possible to convert users coming from an Amazon advertisement	1 January following year
Sp	Yieldify => Allows Yieldify to function	1 year
4303last	Iadvize => Allows Iadvize to function	1 year
4303vvc	Iadvize => Allows Iadvize to function	1 year

In accordance with Deliberation No. 2019-093 of 4 July 2019, adopting guidelines on the application of Article 82 of the French Data Protection Act of 6 January 1978, amended, regarding read and write operations on a user’s device (in particular cookies and other trackers), the Company informs Users that trackers are used to record certain information stored in the memory of their computing equipment/hardware. This information is for the purposes of improving the use and functioning of the Website, and also for understanding how the Website is used by Users, as well as the tools and services that the Company makes available to them. These trackers do not contain any personal information relating to Users. Accordingly, no processing of personal data is carried out in respect of these trackers.

When accessing the Website for the first time, an alert message informs the User about the use of trackers and invites the User to accept the purposes of this usage.  Accepting or refusing the use of trackers has no impact on the User’s browsing experience.
In particular, the alert message details:

• the identity of the data controller(s);
• the specific purposes of the trackers used;
• the option to withdraw consent at any time.
• To guarantee the User’s free, informed and unequivocal consent, the banner will not disappear until he continues browsing.

Without the User’s express prior consent, cookies will not be placed or read:
-    If the User visits the Website (homepage or directly on another Website page) and does not continue browsing: the simple absence of action cannot be deemed an indication of wishes; 
-    Or if a User clicks on the link present in the banner allowing him to configure cookies and, as may be relevant, refuses the placing of cookies.

The User can choose to disable cookies and other tracers at any time. His browser can be configured to inform him of the cookies placed on his device and ask him to accept or refuse them. 

The configuration of each browser is different. It is described in the help menu of the browser which will allow the User to know how he wishes to change his cookie choices.

» Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

• Click on the menu button and select “Options”. 
• Select the “Privacy and security” section. 
• Set the “Storage rules” to “Use personalized settings for the history”.
• Untick the “Accept cookies” box. 
• All changes you make will be automatically saved.

» Internet Explorer: https://support.microsoft.com/en-us/products/windows?os=windows-7

• Click on the Tools button, then on “Internet Options”.
• Click on the “Privacy” tab, then under “Settings”, move the cursor towards the top to block all cookies or towards the bottom to authorize all cookies, then click on OK.

» Google Chrome: https://support.google.com/chrome/answer/95647?hl=en

• Select the icon from the Chrome menu.
• Select “Settings”.
• At the bottom of the page, select “Show advanced settings”.
• In the “Privacy” section, selection “Content settings”.
• Select “Prevent all sites from storing data”.
• Select OK.

» Safari: https://www.apple.com/legal/privacy/en-ww/cookies/

• Click on “Settings” > “Safari” > “Privacy” > “Cookies and website data” 

 
Changing our Privacy Policy 
 
This privacy policy can be amended. The Company therefore recommends that its Users regularly consult this page of the Website. In the event of a significant change to the Privacy Policy, the Company will inform Users thereof.