Data Protection and Privacy Policy

General Data Protection Regulation

1. Policy objective

Les Arcs attaches great importance to the respect for privacy. It is one of the reasons why we have developed a policy specifically aimed at confidentiality and personal data protection.

We are commited to protecting your rights as regards confidentiality and ensuring that your personal data is protected.

This personal data management policy (the “Policy”) outlines the types of personal data collected and the way in which we process and protect this with regard to the services that we offer. This data may comprise information gathered off-line via our reception and marketing departments and online via our websites, applications (including mobile applications) and third party platforms (“Sites”). The policy also reminds you of your rights and how to exercise them.

We have in place technical and organisational measures which safeguard all the personal data that you provide us with against destruction, loss, alteration, disclosure or unauthorised access, whether accidental or illicit.

This external Policy relating to data protection and privacy is produced by Les Arcs, a group composed of Arcs Bourg Saint Maurice Tourisme and ADS represented by their respective directors and the town hall of Bourg Saint Maurice represented by its mayor, each being jointly responsible for the processing.

2. Your rights and how to exercise them

Specific individual rights are granted by laws. Law n°78-17 dated 6 January 1978 relating to information technology, databases and civil liberties, and the general European (EU) regulation 2016/679 from the European Parliament and Council dated 27 April 2016 relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (general data protection regulation) supporting law n° 78-17, all grant the right to informed consent, the right of access or objection to the personal data concerning you as well as the rectification or erasure of any incomplete or inexact information concerning you.

You may also decide to give instructions relating to the storage, erasure and communication of your personal data upon your death.

If you think that the way in which we have processed your personal data infringes legislation concerning data protection, you may submit a complaint with the competent watchdog (CNIL: cnil.fr/fr/plaintes), in the Member State of your usual residence, your place of work or the place where the alleged offence occurred.

You may exercise each of these rights:

o       By sending us an email to the following address: dpo@lesarcs.com

o       By contacting us via one of the online contact forms on our internet sites

o       By contacting us by letter addressed to ABTourisme - 35 rue de la Gentiane - 73700 BOURG SAINT MAURICE for the attention of the DPO.

o       By following the instructions available on the CNIL site at the following address: https://www.cnil.fr/agir

3. Personal data

Personal data is defined as any information that is liable to identify you either directly or indirectly (“Personal data”). It generally includes information such as your last name, your first name, your date of birth, your postal and email addresses, your telephone number, but also other information such as your IP address, your purchase history, the products you have consulted, your connection and navigation data.

We collect your personal data directly in a number of different ways, for example when you provide us with your information when you contact us or when you visit our site.

When you provide us with your personal data, we process it in accordance with this Policy. If you do not want us to process your personal data in this way, please do not provide us with any personal data.

We process your personal data in order to provide you with our services, as detailed below. In some cases, we only process your personal data if you have given your express agreement. In other cases, we might apply other legal basis to process your personal data, such as through a contract binding us with a common legitimate interest.

When we process your personal data on the basis of your consent, we ask you for this consent explicitly and only for a specific intention. We will also ask you to provide us with additional consent if we need to use your personal data for reasons not covered by this Policy.

We invite you to consult the following section for details regarding the different types of personal data that we might collect, the intended use and the legal basis for this processing.

4. Personal data processing

      a. Which data is collected?

We collect and process information such as your last name, first name, postal address, email address, password, date of birth, telephone number, holiday dates, IP address, connection data, navigation data, claims and various requests.

We also collect and process all information that is connected to the management of your account for the site lesarcs.com, including your purchase and booking histories, your preferences and centres of interest, and products and services consulted.

You are informed by an asterisk at the moment of data collection whether this data is obligatory or optional. Some data is collected automatically as a result of your activity on the site, other informaiton may be sent to us by partners.

The data collected on the site arises from the voluntary communication of personal data by visitors. The data that is collected is only intended for the communication of information linked to requests, to tasks carried out and to services rendered as part of the activities proposed by Les Arcs.

     b.When is the data collected?

We collect the information that you have provided us when:

➢     You create an account on our sites and applications
➢     You navigate on our sites and applications
➢     You make a purchase or a booking through our site or directly in the tourist offices
➢     You contact us via one of our contact forms
➢     You contact us by telephone or letter
➢     You respond to a job offer or you send us a spontaneous job application via our site
➢     You download any documentation from our site
➢     You consult our news, articles and information or advertising banners

    c.Why is the data collected?

We use your personal data mainly for the following purposes:

          ▪ Customer relations management

We need information about you in order to manage our customer accounts, your purchases and orders and any follow-up action concerning these, in particular for invoicing, accounting, customer service management such as satisfaction surveys, claims and after-sales management, customer selection for market research and for surveys.

          ▪ Payment of your orders

All payments made by you on our sites are secure. Les Arcs does not collect your payment data but only a payment user name and the first 6 and final 4 numbers on your card in order that you may recognise the card used for payment. Full bank details are only collected by our PCI-DSS compliant payment service provider in order to guarantee payment security.

When you pay for an order, the data on the card used for the payment is kept for the time required for the transaction then for an additional 15 months from the moment of payment in order to provide evidence of the transaction.

          ▪ Service personalisation and messages sent to you

Data regarding you allows us to improve and personalise the services we offer you and the information we send you. For example, we can send you personalised emails or recommend similar products to those that you have already bought or consulted and that match your centres of interest.

          ▪ Third party sales prospecting

Data regarding you may be sent to commercial partners and in particular to marketing and advertising organisations. No email or sms sales prospecting is carried out without your consent. As regards postal or telephone sales prospecting carried out by partners, you can inform us at any moment of your objection to this.

          ▪ The fight against Fraud

Data collected on our site is also processed in order to ensure payment security and as such guarantee an optimal service quality. Les Arcs evaluates the level of risk of fraud for each order. As part of this analysis, Les Arcs is liable to involve partners specialised in the prevention of risk to help fine-tune its analysis. Some of these partners may have access to the results of the analysis carried out and may use these for their own purposes in order to inform their own database regarding incidents.

ABTourisme may, depending on the results of inspections carried out on orders, take further security measures, and in particular may ask for additional documents or an alternative mode of payment. These measures may lead to the suspension of the order and indeed to the cancelation of the order if the results of the analysis cannot provide a guarantee of security.

          ▪ Personalisation of online advertising (targeted advertising)

We may use data which does not allow us to identify you directly (technical user names or sociodemographic data) to adapt the advertisement that you see on our site or on our subsidiaries’ sites. Your data may be crossed with navigation data and other information collected from our subsidiaries, and made anonymous before use, such as your age group or your gender in order to create your user profile and to associate centres of interest to this which will generate the type of advertisement that you will see. For more information and to manage your cookies, please go to the “Cookies” page of the site.

We use tracking technologies and in particular cookies in order to adapt the advertising to your needs and centres of interest on our sites and those of our partners. We invite you to consult the section on Cookies to obtain detailed information on the use of cookies and other similar technologies and to see the choices that you have concerning these.

          ▪ Management of your requests and of the Newsletter

We collect your contact data as well as the content of your requests in order to be able to provide you with appropriate information. We aim in particular to provide you with the responses to your questions and various requests and to manage our mailing list for the newsletter.

          ▪ Management of your job application

Our site includes a page where you can apply spontaneously for a job or respond to a job advertisement. In this particular case, we are liable to collect and process data relating to your professional experience and your qualifications as part of the recruitment activities carried out by our Human Resources department.

          ▪ Site security

We collect some navigation data to allow us to guarantee service security and to detect, avoid or track any malevolent intention or digital incursion or any breach of the conditions of use of our Services.

          ▪ Statistical and performance analysis of our site

We may use data to help continuously improve our understanding of internet users or for statistical purposes to analyse our site activity and to improve the services that we offer. We carry out audience counts where we analyse, for example, the number of pages viewed, the number of visits to the site, visitor activity on the site as well as the frequency of return visits.

5. Communication and information

Your contact details as well as your personal information that we obtain may be used to send you the following information:

          ▪ Service emails

Following an order or booking or to manage your information request, you will receive an email which will allow you to track your request, your newsletter inscription or your order.

          ▪ Newsletters

If you are a customer and you do not object, you may receive information and offers from Les Arcs by electronic communication (email, sms, etc.). These newsletters allow you to stay informed of news in Les Arcs and of any benefits you may be able to take advantage of on products similar to those you have already bought or consulted. We measure the open and click-through rates of our electronic mailings in order to adapt them to your needs.

If you are not a customer and you consent to it, you may also receive this type of communication.

          ▪ Telephone contact

If you do not object (excluding direct prospecting by means of a call processor for which you will be asked for your express consent) you may be contacted by our operators in order to offer you promotions and services linked to those that you have already bought or consulted.

          ▪ Contact by email or telephone

As part of a request or an order, we are liable to contact you in order to properly manage your request or your order

6. Legal basis and duration of storage

The lawfulness (legal basis) in the processing of your personal data is justified variously according to the way in which we use the personal data. You will find below the legal basis and the duration of storage that we apply to our main types of processing.

     a. Legal basis for processing

Among the applicable legal basis, in accordance with articles 6.1. of the GDPR (European ruling on data protection and privacy) and article 7 of the Data protection Act, we use in particular:

          ▪ Contract: personal data processing is required for the performance of the contract to which you have agreed. This is especially applicable when you have ordered a product or service

          ▪ Consent: you accept the processing of your personal data upon express consent (tick-box, click). You may withdraw this consent at any moment

          ▪ Legitimate interest: ABTourisme has an interest in the processing of your data which is justified, balanced and does not infringe your privacy. In most cases you can object at any moment to any processing carried out on the basis of legitimate interest by informing Les Arcs

          ▪ Legal obligation: your personal data processing is rendered obligatory by a legal text

     b. Duration of storage

Most of the data (for example customer account information and order history) are kept for as long as you remain an “active” customer and for 5 years from your last activity.

Your data is then archived with limited access for an additional period of time for reasons limited and authorised by law (payment, guarantee, litigation, etc.). 

After this period of time, the data is erased.

7. Recipients

The data collected may be transferred to service providers (sub-contractors) used by Les Arcs to provide services as part of the above-mentioned objectives.

We expect these processing service providers to conform to stringent requirements in accordance with legislation in force relating to data protection, in virtue of which they may only process your personal data for us and are obliged to respect the high standards imposed regarding information technology security.

Please note that we never share your personal data with social network platforms. If any changes occur in the future where we are obliged to share your personal data with a social network platform, we will ask for your consent.

Please note that we are liable to share your personal data with law enforcement bodies or other organisations when we have the legal obligation to do so in the case of letters rogatory, judicial summons or court orders requiring us to divulge your personal data.

You are informed that any data concerning you will not, in any event, be transferred for the above-mentioned reasons to any entity outside the European Union that does not provide data protection guarantees at least equal to those provided in the European Union.

8. Data relating to minors

Les Arcs online services are not intended for Minors and consequently Les Arcs does not process data specifically concerning minors as part of its services offered online.

9. Publication and updating of this Policy

This policy is enforceable from 25 May 2018.

This procedure may be updated at any moment.