Privacy Policy

The controller of the personal data collected on the ame-boheme.fr website is Pierre Bouyer, a sole trader based in France.

Contact for your personal data: contact@ame-boheme.fr

For any question about the protection of your personal data, or to exercise your rights, you can write to this address. We reply as soon as possible and within one month at the latest, as required by law.

This policy explains transparently how we collect, use, store and protect your personal data, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the amended French Data Protection Act of 6 January 1978 (loi Informatique et Libertés).

We only collect the data needed for the purposes described below (data minimisation). What we collect depends on the services you use:

Data you give us:

• Newsletter and ebooks: email address and first name (optional). When you sign up, we also record the language of the site, the page you signed up on, your browser's language and time zone, your device type, where your visit came from (referring site, campaign parameters) and your approximate country and city, derived from your IP address, which is not stored.

• Member account: name, email address, password (stored in hashed form, never in plain text), profile photo and any information you choose to add to your profile (bio, city, country, website and social media, date of birth, languages, travel styles, dream destinations), as well as your favourites and travel journals. If you sign in with Google, Google sends us your name, email address and profile photo.

• Comments: name or pseudonym, email address (not published), website (optional), the content of your comment and your IP address.

• Contact and application forms: name, email address, subject and message.

Data collected automatically:

• Audience measurement, with your consent: pages viewed, visit duration, traffic source, device type, browser and country, through Google Analytics (see “Cookies and tracking technologies”).

• Newsletter emails: we record clicks on the links in our emails (email address, link, date) and the total number of opens of each mailing, without identifying who opened it. Clicks, the sign-up page and, for members, the travel styles in their profile are used to infer your interests (destinations, themes) so that we can suggest relevant content.

• Technical data: IP address and connection data processed by our host to serve the pages and protect the website; technical browser signals analysed by the Cloudflare Turnstile anti-bot check on the contact, application, comment and ebook download forms.

Data we do not collect:

We do not collect any “sensitive” data within the meaning of Article 9 GDPR (racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation, biometric or genetic data), nor any banking data: bookings made through our affiliate links are handled directly by the partner platforms.

Each processing operation relies on a specific legal basis:

• Newsletter (new articles, guides, selections and travel tips): your consent (Article 6(1)(a) GDPR), confirmed by clicking the link in the confirmation email (double opt-in).

• Sending the ebook you requested: performance of your request (Article 6(1)(b) GDPR). The ebook is sent to you even if you do not confirm the newsletter subscription.

• Member account (sign-in, favourites, travel journals, profile): performance of the service you request by creating an account (Article 6(1)(b) GDPR).

• Comments: your consent, given by posting the comment (Article 6(1)(a) GDPR). Your IP address is kept on the basis of our legitimate interest in fighting spam (Article 6(1)(f) GDPR).

• Replying to your messages (contact and application forms): our legitimate interest in replying to our readers (Article 6(1)(f) GDPR).

• Audience measurement (Google Analytics) and affiliate partners (GetYourGuide, Travelpayouts): your consent, given through the cookie banner and revocable at any time (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act).

• Website security and the prevention of fraud and spam (hosting, anti-bot check): our legitimate interest (Article 6(1)(f) GDPR).

Your data is never sold, nor used by third parties for advertising profiling.

The ame-boheme.fr website uses cookies and similar technologies in accordance with the ePrivacy Directive and the recommendations of the CNIL (the French data protection authority).

Strictly necessary cookies (exempt from consent):

• Sign-in cookies: keep you signed in if you have a member account and protect the sign-in forms (CSRF security token).

• Anti-bot check: on forms, Cloudflare Turnstile may use technical data to tell a visitor from a bot.

• Your cookie choice is stored in your browser's local storage for 6 months.

These are essential for the website to work and are not used to track you. They do not require your consent (Article 82 of the French Data Protection Act).

Cookies that require your consent:

On your first visit, a banner lets you accept or refuse these cookies, purpose by purpose. Until you have made a choice, none of them is set, and refusing has no effect on your access to the website. Your choice is kept for 6 months, after which the banner is shown again.

• Audience measurement (Google Analytics 4, Google Ireland Limited): pages viewed, visit duration, traffic source and device type, to understand how the website is used and improve it. The data is kept for 14 months at most and is not used for advertising.

• Affiliate partners (GetYourGuide, Travelpayouts): display of activity widgets and tracking of bookings made through our links, so that the corresponding commission is attributed to us. These partners apply their own privacy policies.

Embedded content:

Google Maps only load when you click “Show the map”. YouTube videos are embedded in privacy-enhanced mode or only load when you start playback: YouTube only sets its cookies at that point.

Managing your preferences:

You can change or withdraw your consent at any time with the “Cookie settings” link at the bottom of every page. You can also delete cookies in your browser settings:

• Chrome: Settings → Privacy and security → Cookies

• Firefox: Settings → Privacy & Security → Cookies

• Safari: Settings → Privacy → Cookies

• Edge: Settings → Cookies and site permissions

By subscribing to our newsletter, you agree to receive our emails: new articles and travel guides, themed selections (best destinations by season, weekend ideas, etc.), practical tips and deals, and occasionally information about our partners when it is useful to our readers.

Confirmation: your subscription only becomes active once you click the link in the confirmation email (double opt-in). An unconfirmed subscription is deleted after 30 days.

Frequency: as and when we publish, with no fixed schedule.

Unsubscribing: every email contains an unsubscribe link that lets you withdraw your consent at any time, without giving a reason. You can also write to us at contact@ame-boheme.fr. Your address is then kept on a suppression list, with the date you unsubscribed, solely to make sure you no longer receive our emails; you can ask for it to be erased completely at the same address.

Email provider: Resend (Resend, Inc., United States), which sends our emails from servers located in Ireland and is certified under the EU-US Data Privacy Framework.

We never share, sell or rent your email address to third parties.

Creating an account is optional. It lets you save your favourites and travel journals and prefills your comments.

You can view and edit your information in “My account”, and download a copy of your data from “My account” → “Settings”.

Deletion: on the same page, you can delete your account. It is deactivated immediately, then permanently erased within 30 days together with your profile photo, favourites and travel journals. Your published comments remain visible under the name you gave, no longer linked to the account, unless you ask us to delete them.

Your personal data is never sold, rented or transferred to third parties for commercial or advertising purposes.

It is only shared with our technical service providers, within the limits of their services and under commitments that comply with the GDPR:

• Vercel Inc. (hosting and delivery of the website), United States: transfers covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

• Supabase Inc. (database and file storage): data hosted in Ireland (European Union); any access from the United States is covered by the European Commission's standard contractual clauses.

• Resend, Inc. (sending emails): sent from Ireland; the company is certified under the EU-US Data Privacy Framework.

• Google (Google Analytics with your consent, Google sign-in if you choose it, YouTube videos and Google Maps when you start them): Google Ireland Limited and Google LLC, certified under the EU-US Data Privacy Framework.

• Cloudflare, Inc. (Turnstile anti-bot check on forms): certified under the EU-US Data Privacy Framework.

• GetYourGuide and Travelpayouts (affiliate partners), only with your consent.

These providers only process your data on our instructions, must keep it confidential and secure, and may not use it for any other purpose.

Apart from these cases, your data may only be disclosed to third parties where required by law (court order, request from a competent administrative authority).

Your data is kept for no longer than the purpose of the processing requires (Article 5(1)(e) GDPR):

• Newsletter: for as long as you are subscribed; an unconfirmed subscription is deleted after 30 days. After you unsubscribe, the address remains on the suppression list described above.

• Member account: for as long as the account exists; permanently erased 30 days after you delete it.

• Contact and application forms: 12 months from receipt, unless there is a dispute or a legal obligation.

• Comments: for as long as the comment is online; deleted on request.

• Audience measurement: 14 months at most.

• Cookie choice: 6 months.

At the end of these periods, the data is deleted or irreversibly anonymised.

Under the GDPR and the French Data Protection Act, you have the following rights over your personal data:

• Right of access (Article 15 GDPR): to know whether your data is being processed and to obtain a copy of it, with information about the processing.

• Right to rectification (Article 16 GDPR): to have inaccurate or incomplete data corrected.

• Right to erasure (Article 17 GDPR): to have your data deleted when it is no longer needed, when you withdraw your consent or when the processing is unlawful.

• Right to restriction of processing (Article 18 GDPR): to have processing suspended in certain cases (disputed accuracy, unlawful processing, data needed to establish legal claims).

• Right to data portability (Article 20 GDPR): to receive your data in a structured, machine-readable format. Members can download it directly from “My account” → “Settings”.

• Right to object (Article 21 GDPR): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest.

• Right to withdraw your consent at any time (newsletter, cookies, comments), without affecting the lawfulness of processing carried out before the withdrawal.

• Right to give instructions about what happens to your data after your death.

How to exercise your rights: write to contact@ame-boheme.fr, stating the email address concerned and the right you wish to exercise. We may ask for proof of identity if there is reasonable doubt. We reply within one month; this period may be extended by two months for a complex request, in which case we will let you know.

Complaints: if you believe that the processing of your data does not comply with the rules, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure (Article 32 GDPR).

Technical measures:

• The whole website is served over HTTPS (TLS): exchanges between your browser and our servers are encrypted.

• Our host (Vercel) and our database provider (Supabase) encrypt data at rest and in transit and hold security certifications (SOC 2 Type II).

• Member passwords are stored in hashed form; access to the administration area and to third-party services is protected by strong passwords and, where possible, two-factor authentication.

• Forms are protected against spam and automated submissions (anti-bot check, rate limiting).

Organisational measures:

• Access to personal data is limited to the people who need it.

• Our providers are chosen for their security and data protection guarantees.

If a data breach is likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible (Articles 33 and 34 GDPR).

The ame-boheme.fr website is a travel information website open to everyone. We do not knowingly collect personal data from children under 15 without the consent of their parents or legal guardians.

If you are a parent or guardian and find that your child has given us personal data without your consent, write to us at contact@ame-boheme.fr and we will delete it as soon as possible.

Our website contains many links to third-party websites: booking platforms, airlines, tourist offices, social networks, our partners' websites and activity and excursion providers.

These links are provided to help you plan your trips. Once you leave our website, the terms of use and privacy policy of the website concerned apply.

We have no control over how these websites collect and process data. We encourage you to read their privacy policies, especially before giving them any personal or banking data.

We may change this policy, in particular to reflect changes in the law, in our services or in our providers.

If a change significantly affects your rights or the way your data is processed, we will let you know through a visible notice on the website and, if you are a subscriber, by email.

The date of the last update is shown at the top of this page. The version in force is the one published on the website on the date you consult it.

For any question about this policy, to exercise your rights or to report a security issue:

• Email: contact@ame-boheme.fr

• Contact page: contact us

Please state what your request is about (exercising a right, a question about cookies, a report…) so that we can deal with it quickly.