Privacybeleid

Dit Privacybeleid informeert de gebruikers van pickadest.com over de verwerking van hun persoonsgegevens en over de regels die worden toegepast om deze te beschermen. Het vormt een aanvulling op de Algemene Gebruiksvoorwaarden.

The data controller is Pickadest, 200 rue de la Croix Nivert, 75015 Paris, France, reachable at contact@pickadest.com.

The Site requires no registration and collects no traveller identity. It processes no name, no date of birth, no passport number and no payment data — the Seller asks for those, on its own website, after redirection. The following are processed: • Flight search criteria: trip type, departure and arrival airports, dates and number of travellers by category. They serve only to compose the link that launches the search on the partner's site — the Site displays no offers and queries no service with these criteria. • Display preferences, stored in cookies on the device: currency, market, and the most recent search criteria. • Saved destinations and search history, stored in the browser. If the User signs in, their saved destinations are also synced with our servers, so they can be found on their other devices. • Optional account: email address and display language, used to sign in — through a link sent by email or a Google account — and to sync saved destinations. • Reviews left voluntarily: rating, comment, email address if the User chooses to give one, page consulted, language, browser type, and an irreversible fingerprint of the IP address — the address itself is not kept. • Technical security data: rate-limiting identifiers, server error logs.

Data is processed to display offers matching the search, to remember display preferences between visits, to answer messages received, to protect the Site against abusive use, and to improve the service from reviews.

• Displaying the catalogue and remembering preferences rest on Pickadest's legitimate interest in providing a working service, and on the User's own request. • Reviews rest on consent, the User choosing to submit them. • Protection against abuse rests on the legitimate interest in preserving the availability of the service.

Data is neither sold, rented nor transferred. The Site no longer queries any search interface: it therefore sends no data to a partner from its servers. When the User clicks a link to a partner, it is their own browser that connects to that partner's site, and the criteria they entered — dates, airport, number of travellers — travel inside that link's address. The partners concerned are: • Kiwi.com s.r.o. (Czech Republic, European Union) for flights; • Expedia Group, including Hotels.com (United States) for accommodation; • GetYourGuide Deutschland GmbH (Germany, European Union) for activities. Each becomes a controller for what it collects on its own site, where its own privacy policy applies. Pickadest has no access to it. The Site's host (Google Cloud, Belgium region) and its database (Supabase, United Kingdom region) process data on behalf of Pickadest, as processors.

Application hosting is located in Belgium. The database is hosted in the United Kingdom, a country recognised as providing an adequate level of protection by the European Commission decision of 28 June 2021. Google and Cloudflare services may involve transfers to the United States, framed by the European Commission's standard contractual clauses and, where applicable, by the Data Privacy Framework.

• Preference cookies: thirteen months at most. • Saved destinations and search history: kept in the browser until the User deletes them. Those attached to an account are kept until the account is deleted. • Account: kept until its deletion, which can be requested at contact@pickadest.com. • Reviews: the rating and comment are kept without time limit, as content useful to improving the service. The email address, IP fingerprint and browser type attached to them are deleted at the latest thirteen months after submission, beyond which they no longer serve to answer the User. The review then remains with nothing identifying its author. • Rate-limiting identifiers: twenty-four hours. • Technical logs: thirty days.

The Site sets only cookies necessary to its operation or to a feature expressly requested by the User: • MARKET — the country of consultation, which determines the language and the partners offered; • CURRENCY — the display currency; • favourited destinations, kept on the device; • the sign-in session, if the User creates an account. These cookies are exempt from consent under article 82 of the French Data Protection Act: they serve neither advertising, nor audience measurement, nor profiling. The Site sets no advertising tracker, no analytics tool and no social network button. Links to our merchant partners, however, go through affiliate platforms — Partnerize for Hotels.com and Expedia — which set a cookie on the partner's domain at the moment of the click, so that any resulting booking can be attributed to Pickadest. That happens AFTER the User has left the Site, on the partner's domain and under their responsibility. Not clicking those links is enough to avoid it.

Exchanges with the Site are encrypted in transit. Database access is restricted and authenticated. IP addresses associated with reviews are turned into an irreversible fingerprint before storage, so that they cannot be reconstructed.

Under the GDPR, the User has rights of access, rectification, erasure, restriction, objection and portability. These rights are exercised at contact@pickadest.com. Given how little data is processed, a request should include something allowing the record to be found — for example the email address given when submitting a review. The User may lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr.

The Site is intended for an adult audience and does not knowingly collect data concerning minors. As no identity data is requested, no processing specifically targets minors.

This policy may be amended. The version that applies is the one published on the Site.