Privacy Policy

Warning: this text is a working draft translated by a non-lawyer assistant from the French original. It must not be published as-is without validation by a legal professional. The French version prevails as the legally binding document. This English translation is provided for informational purposes only.

Important: This Privacy Policy is governed by French law and the European Union’s General Data Protection Regulation (GDPR). References to legal provisions refer to the French legal framework and EU regulations.

This Privacy Policy aims to present, in a transparent and general manner, the way in which GUESTRAVELER processes the DATA of USERS (including MEMBERS) and protects their privacy when they connect to the WEBSITE or download the APP, access the PLATFORM and wish to benefit from the SERVICE or make REPORTS.

Capitalized terms used in this Privacy Policy have the same meaning as those defined in the Terms of Use.

In particular, the notion of DATA is that referred to in Article 4 of the GDPR. The same applies to the notion of processing.

This Privacy Policy aims to inform USERS (i) of the manner in which GUESTRAVELER collects, uses and discloses their DATA, and (ii) of the rights they have over their DATA.

It applies when USERS visit the PLATFORM and also when they register to access the NOHÔ matchmaking services on the APP or WEBSITE and when, as MEMBERS, they use the SERVICE.

Identification of the data controller: GUESTRAVELER, a simplified single-shareholder joint-stock company (SASU) with share capital of 13,000 euros, registered under number 821 903 374 with the Caen Trade and Companies Register, whose registered office is located at 73 rue Marie Curie, 14200 Hérouville-Saint-Clair, France. Contact for any question regarding data protection: contact@noho.world.

Table of Contents

1. DATA collected and processed by GUESTRAVELER and/or transmitted to third parties
2. Processing activities carried out
3. Methods of collecting DATA
4. Purposes of collection and their legal bases
5. Duration of DATA retention
6. Recipients of DATA
7. Transfer of DATA
8. Technical and organizational measures
9. Retention and security of DATA
10. Procedure in case of data breach
11. Rights of USERS (and MEMBERS)
12. Duties of MEMBERS
13. Information and complaint procedures
14. Modifications to the Privacy Policy
15. Cookies section

1. DATA Collected and Processed by GUESTRAVELER and/or Transmitted to Third Parties

The DATA collected is primarily:

• Information obtained when the USER accesses the WEBSITE or APP, such as their IP address, connection information.
• Information entered by the USER when registering on the PLATFORM or subsequently when completing their profile, offering or benefiting from a PASSION SHARING EXPERIENCE: last name, first name, email and postal address, phone number, photograph, video, date of birth, profession, password, communication content information (phone, SMS, emails, etc.).
• Information retrieved from third-party sources via social networks, when the USER has authorized this.
• Technical information related to the USER’s browsing on the WEBSITE or APP.
• Information on complaints and REPORTS.

2. Processing Activities Carried Out

GUESTRAVELER carries out the following DATA processing activities related to the PLATFORM and SERVICE:

• USER management
• ACCOUNT management
• NOMAD management
• HOST management
• PASSION SHARING EXPERIENCE management
• Messaging management between MEMBERS
• Cookie management on the PLATFORM
• REPORT management
• PLATFORM security management

3. Methods of Collecting DATA

GUESTRAVELER collects data in two ways:

Through direct input of data communicated by USERS and MEMBERS when they visit the WEBSITE or APP, make contact via the contact form, create an account, offer or register for a PASSION SHARING EXPERIENCE, use the internal messaging, when they access the PLATFORM on the WEBSITE or APP, when they browse the PLATFORM or use the SERVICE, or when they leave REVIEWS on the PLATFORM. Depending on the nature of the collection, it is based on performance of the contract, on GUESTRAVELER’s legitimate interest, or on the free, specific, informed and unambiguous consent of the data subject.

Through the USERS’ use of the PLATFORM and MEMBERS’ use of the SERVICE (their IP address, their connection references to the PLATFORM and SERVICE, their browsing, the name of the operating system used, the language, the GPS functionality or any other information automatically disclosed by the computer or smartphone used).

GUESTRAVELER is also likely to use cookies to obtain information about USERS or to improve the functionality of the media. If the USER does not wish their DATA to be collected via cookies, they can refuse their deposit via the cookie management banner or disable their support in their browser. This operation may however alter the performance and functionality of their browsing on the PLATFORM.

More specifically

When the USER accesses the PLATFORM

GUESTRAVELER does not collect or retain any personal data when the USER accesses the PLATFORM and browses the WEBSITE or APP if they refuse non-essential cookies and if they do not contact GUESTRAVELER via the contact form.

If they accept cookies, please refer to the corresponding section.

If they fill in a contact form, the following data they have entered will be collected by GUESTRAVELER: first name, last name, email address, subject of message, content of message. This DATA will be used to process the message, respond to the USER and will be retained by GUESTRAVELER for one year without GUESTRAVELER using it for any other purpose than keeping a secure record of the USER’s message and complying with its legal and regulatory obligations.

When the USER wishes to become a MEMBER

The USER is invited to provide DATA by completing an ACCOUNT opening form that indicates which DATA is required.

GUESTRAVELER thus collects the following DATA from USERS who wish to become MEMBERS: email address, first name, last name, date of birth, password (created by the USER).

The USER may choose not to provide the requested DATA, but this may limit their access to the SERVICE, in particular for booking PASSION SHARING EXPERIENCES.

When the MEMBER uses the SERVICE

The MEMBER is invited to offer (as a HOST) or benefit from (as a NOMAD) a PASSION SHARING EXPERIENCE and to communicate additional DATA for this purpose, such as:

• Useful additional DATA (phone numbers, profession, qualifications, photographs representing them, languages spoken, etc.).
• Data related to the PASSION SHARING EXPERIENCE (contact details, schedule, photographs, etc.).
• Data related to payment and allocation of BOOKING FEES and HOST COMPENSATION (in particular bank details for HOSTS).
• Data related to REVIEWS.

4. Purposes of Collection and Their Legal Bases

Any data collection by GUESTRAVELER is carried out for a specific and legitimate purpose. In accordance with Article 6 of the GDPR, each purpose is based on an identified legal basis, of which the table below provides an indicative summary.

DATA collected on the PLATFORM and within the framework of the SERVICE is, in principle, used by GUESTRAVELER within the framework of the stated purpose.

5. Duration of DATA Retention

DATA is retained for the duration necessary to exercise the stated purpose.

The following retention periods apply in particular:

• Data of an active MEMBER ACCOUNT: for the entire duration of the ACCOUNT, plus one (1) year from its closure, unless a longer legal duration applies.
• ACCOUNT inactive for three (3) years: automatic deletion after reminder if the MEMBER does not respond before the end of this period.
• Connection log data: one (1) year, in accordance with provisions applicable to electronic communications operators.
• Accounting and invoicing data: ten (10) years, in accordance with Article L123-22 of the French Commercial Code.
• Commercial prospecting data (newsletters): until withdrawal of consent.
• Cookies: maximum duration of thirteen (13) months from deposit, USER choice renewed every six (6) months.

In case of inactivity on an ACCOUNT for a period of three (3) years (and in the absence of prior closure of the ACCOUNT by the MEMBER), the DATA relating to said MEMBER is deleted.

6. Recipients of DATA

GUESTRAVELER is the primary recipient of DATA.

However, certain DATA may be transmitted to external service providers of GUESTRAVELER acting as processors, such as payment services and IT services providing services on behalf of GUESTRAVELER. The list of main processors appears in Article 9 below.

In addition, when a MEMBER offers or registers for a PASSION SHARING EXPERIENCE, they have knowledge of the last name, first name, email address and phone number of the MEMBER organizing the PASSION SHARING EXPERIENCE or participating in it. Each MEMBER must respect the rights of other MEMBERS in accordance with the provisions of Article 12 below.

7. Transfer of DATA Outside the European Union

Some of GUESTRAVELER’s processors, notably those involved in payment management (STRIPE), audience measurement (Google), marketing tracking (Meta) and email management (Brevo), may transfer data to countries located outside the European Union, in particular to the United States.

These transfers are governed by the mechanisms provided for in Chapter V of the GDPR, mainly:

• adequacy decisions adopted by the European Commission on the basis of Article 45 of the GDPR, in particular the adequacy decision of July 10, 2023, concerning the EU-US Data Privacy Framework, for certified US processors;
• standard contractual clauses adopted by the European Commission under Article 46 of the GDPR, supplemented where appropriate by additional technical and organizational measures, for transfers not covered by an adequacy decision.

As data controller, GUESTRAVELER undertakes to ensure that USER DATA is protected in accordance with the legislation in force within the European Union, regardless of the location of processing or of the processors concerned.

8. Technical and Organizational Measures

GUESTRAVELER undertakes to implement appropriate technical and organizational measures, proportionate to the nature, scope, context and purposes of processing.

The processing of DATA collected on the SERVICE has been the subject of internal measures intended to ensure its compliance with the General Data Protection Regulation, through the implementation of appropriate technical and organizational measures to respect the security and confidentiality of data.

9. Retention and Security of DATA

As data controller, GUESTRAVELER is responsible for the retention and security of USER and MEMBER DATA.

In this regard, GUESTRAVELER uses processors also subject to the obligation to comply with applicable legislation and regulations on data protection.

The main processors of GUESTRAVELER are as follows:

• IMAGILE MH Communication, 171 rue Epron, 14200 Hérouville-Saint-Clair, France, technical support for the PLATFORM.
• ALWAYSDATA, 62 rue Tiquetonne, 75002 Paris, France, hosting of the PLATFORM.
• STRIPE Payments Europe Ltd. (Ireland), payment processing.
• Google Ireland Limited, audience measurement via Google Analytics.
• Meta Platforms Ireland Limited, marketing tracking via Meta Pixel.
• Brevo (formerly Sendinblue), 106 boulevard Haussmann, 75008 Paris, France, marketing email management.
• Tarteaucitron, cookie preference management.

This list is provided for information purposes and is subject to change. USERS may obtain the updated list by writing to contact@noho.world.

10. Procedure in Case of Data Breach

In accordance with Article 33 of the GDPR, any DATA breach of which GUESTRAVELER becomes aware and which is likely to result in a risk to the rights and freedoms of natural persons will be notified to the French Data Protection Authority (CNIL) within a maximum period of seventy-two (72) hours from becoming aware of the breach.

In accordance with Article 34 of the GDPR, when the breach is likely to result in a high risk to the rights and freedoms of the data subjects, GUESTRAVELER will communicate this breach to the USER concerned as soon as possible, except in cases provided for by the GDPR (appropriate protection measures implemented, subsequent measures making the occurrence of the high risk unlikely, disproportionate effort justifying public communication).

11. Rights of USERS (and MEMBERS)

USERS have the right to obtain confirmation from GUESTRAVELER as to whether or not DATA concerning them is being processed.

If the answer is positive, the data subject may request access to the DATA being processed and receive a copy of said DATA as well as information relating to the processing carried out (purposes, categories of data, recipients of DATA, retention period, etc.).

USERS have the right to request that DATA concerning them be, as the case may be, rectified, completed or erased. In some cases, the processing of DATA may be limited instead of being erased. USERS may, under the same conditions, request the portability of the DATA they have provided to GUESTRAVELER, in a structured, commonly used and machine-readable format.

USERS also have the right to withdraw their consent at any time when processing is based on consent, without such withdrawal affecting the lawfulness of processing based on consent before its withdrawal.

However, when requests for information are manifestly unfounded or excessive, in particular due to their repetitive nature within the meaning of Article 12 of EU Regulation 2016/679, the data controller may refuse to act on the request and/or require the payment of administrative costs inherent to this request.

The data controller has a response period of one (1) month from the date of receipt of the request. This period may be extended by two (2) months taking into account the complexity and number of requests, the USER being informed of the extension and the reasons. If the request is incomplete, the data controller may request additional information; the deadline is then suspended until receipt of said information.

In the event of reasonable doubt as to the identity of the applicant, GUESTRAVELER may request the communication of a copy of a document justifying the USER’s identity. This request will however not be systematic and will only be made to the strict extent necessary to verify identity, in accordance with the constant doctrine of the CNIL.

Finally, USERS may object, on grounds relating to their particular situation, to the processing of DATA concerning them based on legitimate interest or performance of a task in the public interest. In this case, GUESTRAVELER will cease processing, unless it can demonstrate compelling legitimate grounds that prevail over the interests, rights and freedoms of the USER, or for the establishment, exercise or defense of legal claims. Objection to processing for prospecting purposes is a matter of right.

USERS have the right to request the limitation of the processing of their DATA in the cases provided for by Article 18 of the GDPR.

They also have the right to specify the fate of their DATA upon their death.

Any request for access, rectification, completion, portability, limitation or deletion of USER DATA, as well as any indication of post-mortem use or withdrawal of consent, may be made at any time and must be sent in writing to the following email address: contact@noho.world, or by postal mail to the following address: GUESTRAVELER, 73 rue Marie Curie, 14200 Hérouville-Saint-Clair, France.

12. Duties of MEMBERS

When MEMBERS offer, subscribe to and participate in a PASSION SHARING EXPERIENCE, they have knowledge of DATA of other MEMBERS. They undertake to use this DATA only to enable the PASSION SHARING EXPERIENCE concerned, during the time of organization and execution of the PASSION SHARING EXPERIENCE, to keep it confidential and to delete it at the end of the PASSION SHARING EXPERIENCE. They undertake to respect the privacy and image rights of MEMBERS and not to record, publish or distribute any content reproducing the image or voice of MEMBERS without their prior written authorization to this effect, and to justify this in advance to GUESTRAVELER in order to post it on the PLATFORM.

13. Information and Complaint Procedures

All requests from USERS (including MEMBERS) must be sent to contact@noho.world or by postal mail to the following address: GUESTRAVELER, 73 rue Marie Curie, 14200 Hérouville-Saint-Clair, France, specifying their last name, first name and email address. USERS must specify the subject of their request. In case of reasonable doubt as to the identity of the applicant, a copy of a document justifying their identity may be requested. GUESTRAVELER will respond to USERS within a maximum period of thirty (30) days from receipt of the complete request.

GUESTRAVELER informs USERS that they also have the right to lodge a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

14. Modifications to the Privacy Policy

GUESTRAVELER complies with the provisions of the General Data Protection Regulation (GDPR) No. 2016/679 of April 27, 2016, as well as those of French Law No. 78-17 of January 6, 1978, in its version last modified by Law No. 2024-449 of May 21, 2024, and the applicable implementing decrees, in particular Decree No. 2019-536 of May 29, 2019.

GUESTRAVELER reserves the right to modify this Privacy Policy, in particular to comply with developments in applicable legislation and regulations.

The date of the version in force is that appearing at the top of this document. In the event of significant modification, GUESTRAVELER will inform MEMBERS by email.

Cookies

This section supplements the Terms of Use and the Privacy Policy.

Capitalized terms used in this section have the same meaning as those defined in the Terms of Use.

GUESTRAVELER uses cookies and other tracers.

When consulting the WEBSITE, accessing the PLATFORM and/or using the SERVICE, one or more cookies may automatically install on the USER’s computer, mobile phone, tablet or any other terminal (including the MEMBER) via their browser software. GUESTRAVELER also uses mobile service identifiers and other similar technologies. The following provisions aim to help USERS better understand how cookies and other tracers work, what GUESTRAVELER’s policy is regarding cookies and other tracers, and how to use current tools to accept, configure or refuse them.

What is a Cookie?

A cookie is a small text file placed on the hard drive of the USER’s computer or in the memory of their browser and that allows the USER’s computer, mobile phone, or tablet to store various technical data that can be read when consulting a website. This data may concern the number of visits to the WEBSITE or APP made by the USER, their IP address, the pages of the WEBSITE or APP visited, etc.

Cookies Used by GUESTRAVELER

GUESTRAVELER uses these technologies primarily to improve the functionality of the WEBSITE and APP, to recognize the USER and facilitate their use of the WEBSITE, APP, PLATFORM and SERVICE. These technologies can also help GUESTRAVELER detect certain types of fraud.

GUESTRAVELER uses different categories of cookies, whose classification takes into account CNIL recommendations. Analytical and marketing cookies are only deposited after the USER’s prior consent has been collected, in accordance with Article 82 of the French Data Protection Act.

Strictly Necessary Cookies

GUESTRAVELER installs this type of cookies to ensure the proper functioning of the WEBSITE, APP, PLATFORM and SERVICE. They cannot be disabled. They allow the use of certain features of the WEBSITE and APP. The data recorded is deleted as soon as the USER leaves the page. These tracers do not store any personal data.

Functionality Cookies

GUESTRAVELER places cookies on the USER’s terminal to allow proper browsing on the WEBSITE and APP. These cookies allow the functionality of the WEBSITE and APP to be improved and personalized. Failing acceptance of these cookies, some or all of their functionality may not work for the USER.

Analytical Cookies

GUESTRAVELER uses Google Analytics 4 for audience measurement of the WEBSITE and APP. These cookies analyze browsing and enable the SERVICE to be improved. The data collected via these cookies is only deposited after the USER’s prior consent has been collected and is retained for a maximum period of thirteen (13) months.

Marketing Cookies

GUESTRAVELER uses marketing cookies, in particular those of Meta (Facebook Pixel) and Brevo, for the purposes of tracking conversions and managing marketing email campaigns. These cookies are only deposited after the USER’s prior consent has been collected.

Cookies Summary Table

Advertising Cookies

GUESTRAVELER does not use advertising cookies.

Accept All, Reject All, Customize

When a USER accesses the WEBSITE or APP, a window allows them to be informed of their rights and data processing.

USERS can block certain types of cookies. However, the browsing experience and services that GUESTRAVELER will be able to offer may be impacted.

Accept All:

By accepting the deposit of cookies and other tracers and browsing witnesses, the USER expresses their consent to their use.

Reject All:

To refuse all cookies (other than those necessary for consulting the WEBSITE or APP), the USER may click on “Reject All.” This choice will be taken into account for six (6) months, then will be proposed again to the USER upon a new connection.

The USER may also configure their browser to refuse cookies. For example:

• With Microsoft Edge: Settings > Cookies and site permissions > Cookies and site data > choose desired options.
• With Firefox: Menu > Settings > Privacy & Security > choose desired options.
• With Chrome: Menu > Settings > Privacy and security > Cookies and other site data > choose desired options.
• With Safari: Preferences > Privacy > Cookies and website data > choose desired options.

Customize:

On the cookie banner, click on the “Customize” button.

The USER can then choose to accept the cookies they wish by checking the corresponding box. The USER’s choice will be taken into account for six (6) months, then the choice will be proposed again to the USER at the end of this period.

Withdraw Consent:

At any time, the USER may withdraw their consent by going to “Manage my cookie preferences” at the bottom of this page. Another option is to modify the cookie settings.

Rights of USERS Regarding DATA Communicated by Cookies

The rights of USERS regarding their DATA are those referred to in Article 11 above of the Privacy Policy. They include the right of access, rectification, revocation of consent when given by the USER, transfer of data to another data controller, objection to data processing. The USER may also indicate the fate they wish for their data in case of death.

These rights may be exercised with GUESTRAVELER by sending an email to contact@noho.world specifying the USER’s last name, first name and email address, who must also specify the subject of their request. In case of reasonable doubt as to the identity of the applicant, a copy of a document justifying their identity may be requested. GUESTRAVELER will respond to the USER within a maximum period of thirty (30) days.

Third-Party Cookies

Some cookies deposited on the PLATFORM are issued by third parties, in particular Google (audience measurement), Meta (marketing), Stripe (payment) and Brevo (email management). These cookies involve the transfer of data to these third parties, under the conditions described in Article 7 of this policy. USERS are invited to consult the privacy policies of these third parties to learn about their data processing practices.

In addition, third-party social network Plug-ins such as Facebook, X, LinkedIn, YouTube are installed on the WEBSITE and APP. The third party could have access to the information that the USER consults on the WEBSITE or APP if they are logged in to their account opened with these third-party social networks. GUESTRAVELER invites USERS to consult the privacy policies of said third parties to learn about their practices in terms of privacy policy and cookies.

More Information

By consulting the CNIL website (Cookies: tools to master them), USERS can benefit from additional information on their rights and cookie management, in particular on the means to configure their browser to be informed of cookies and, where applicable, to refuse them.