Policy of privacy

1. Data controller

SPL Clermont Auvergne Volcans
Tourist Office — Maison du Tourisme
Place de la Victoire · 63000 Clermont-Ferrand
SIRET : 823 951 876 00023
DPO email : dpo@clermontauvergnevolcans.com
Phone : 04 73 98 65 00

2. Data collected

We collect the following data depending on the context:

a) Site navigation

• IP address (anonymised after collection)
• Pages visited, visit duration, referrer
• Browser type and operating system
• Accessibility preferences (stored locally)

b) Contact form

• First name, last name, email address
• Phone (optional)
• Message content

c) Ticketing and orders

• Full identity and contact details
• Payment data (handled directly by our secure provider — not stored by us)
• Purchase history

d) Newsletter

• Email address
• Content preferences (optional)

e) Travel notebook

• Favourites and saved places (stored only in your browser, locally)

3. Purposes and legal bases

We process your data for the following purposes:

• Audience measurement — Legitimate interest (Matomo, hosted in France, anonymised data)
• Reply to your contact requests — Contract performance / Legitimate interest
• Processing orders and bookings — Contract performance
• Sending the newsletter — Explicit consent (unsubscribe at any time)
• Service improvement — Legitimate interest
• Compliance with legal obligations — Legal obligation

4. Data recipients

Your data may be shared with:

• Alliance Réseaux / Welogin — ticketing provider (contract performance)
• SMTP provider — sending transactional emails
• APIDAE — regional tourism database (read only)
• Matomo — audience analytics tool, hosted in France, anonymised data

No personal data is sold to third parties for commercial purposes.

5. Retention period

• Contact data : 3 years from the last contact
• Order data : 5 years (accounting obligation)
• Newsletter : until unsubscription + 1 year
• Anonymised navigation logs : 13 months (CNIL)
• Payment data : not retained (handled by external provider)

6. Your rights

Under the GDPR, you have the following rights:

• Right of access — obtain a copy of your data
• Right of rectification — correct inaccurate data
• Right to erasure — request the deletion of your data
• Right to restriction — restrict processing
• Right to portability — receive your data in a structured format
• Right to object — object to processing based on legitimate interest
• Withdrawal of consent — at any time for processing based on consent

To exercise these rights, contact our DPO: dpo@clermontauvergnevolcans.com. We reply within a maximum of 30 days.

7. Cookies and trackers

This site uses cookies. See our cookie policy for the full details.

• Essential cookies — site functionality (session, cart, accessibility) — no consent required
• Audience-measurement cookies — Matomo (anonymised, hosted in France) — consent requested

You can manage your cookie preferences at any time using the button Cookies at the bottom of the page.

8. Security

We implement appropriate technical and organisational measures to protect your data:

• HTTPS encryption (SSL/TLS) of all communications
• Data access restricted to authorised staff
• Hosted in France (data subject to French and European law)
• No bank details stored on our servers

9. Transfers outside the European Union

We do not transfer personal data outside the European Union. All providers we use are hosted in France or in the EU.

10. Contact & complaints

For any question regarding your personal data:

• Email: dpo@clermontauvergnevolcans.com
• Mail: SPL Clermont Auvergne Volcans — DPO — Place de la Victoire, 63000 Clermont-Ferrand

If you believe the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the CNIL (cnil.fr).

Legal notice ·Cookie policy ·Terms ·Contact