Personal data protection charter
Because your privacy is important to the Grand Aquarium de Touraine, we have created a confidentiality pact that governs the way in which your personal data is collected, used, disclosed, transferred and stored.
I. Name and address of the Data Controller
The Controller within the meaning of the EU General Regulation 2016/679 on the protection of personal data and the national laws on the protection of personal data in force within the Member States, is :
The Communication Manager
Tel: 02 47 23 44 57
E-mail : contact@grandaquariumdetouraine.com
SNC PARCS DE TOURAINE ET VAL DE LOIRE
Tel: 02 47 23 44 57
E-Mail : contact(at)grandaquariumdetouraine.com
Website: www.grandaquariumdetouraine.com
II. Personal Data Protection Officer
The Referent appointed by the Manager is :
Céline Bellanger
Tel: 02 47 23 44 57
E-Mail: contact@grandaquariumdetouraine.com
Website: www.grandaquariumdetouraine.com
III. General information on the processing of personal data
1. Scope of processing of personal data
We process the personal data of our users only to the extent necessary to provide them with access to our website and functional content and services. The processing of our users' personal data is in principle only carried out with their consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and where the processing of the data meets a legal obligation.
2. Legal basis for processing personal data
Insofar as we obtain the consent of users for the processing of their personal data, Article 6(1)(a) of the General Data Protection Regulation (GDPR) serves as the legal basis.
For the processing of personal data necessary for the performance of a contract to which the user is a party, Article 6(1)(b) of the General Data Protection Regulation (GDPR) serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Article 6(1)(c) of the General Data Protection Regulation (GDPR) serves as the legal basis.
In the event that vital interests of the user or another natural person require the processing of personal data, Article 6(1)(d) of the General Data Protection Regulation (GDPR) serves as the legal basis.
If the processing is necessary to safeguard the legitimate interests of our company or of a third party, and if the interests, fundamental rights and freedoms of the user do not override this legitimate interest, Article 6(1)(f) of the General Data Protection Regulation (GDPR) serves as the legal basis for the processing.
3. Data erasure and retention period. Users' personal data are kept for no longer than is necessary for the purpose for which they were collected. Beyond that time, it will be deleted, anonymised or access to it will be blocked. In addition, the retention of data may be provided for by the European or national legislator in EU regulations, laws or other rules to which the controller is subject. The blocking of access to the data, the deletion of the data or the anonymisation of the data also takes place after the expiry of the retention period prescribed by the aforementioned regulations, unless it is necessary to retain the data for the conclusion or performance of a contract.
IV Provision of the website and creation of log files
1. Description and scope of processing of personal data
Whenever our website is accessed, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected:
Information on the type of browser and the version used
User's operating system
User's Internet Service Provider
Date and time of access
Websites from which the user's system accesses our website
Websites accessed by the user's system via our website
The data is also stored in our system log files. This does not include the user's IP address or other data that allows the data to be assigned to a specific user. Furthermore, we do not store this data together with other personal data of the user.
2. Legal basis for processing personal data
The legal basis for the temporary storage of data is the legitimate interest under Article 6(1)(f) of the GDPR.
3. Purpose of the processing of personal data
The temporary storage of the IP address by the system is necessary to enable access to the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session.
This purpose is also justified by our legitimate interest within the meaning of Article 6(1)(f) of the GDPR.
4. Duration of storage
Personal data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the collection of personal data enabling access to our website, this is the case when the session is terminated.
5. Right of objection and deletion
The collection of the user's personal data for access to our website and the storage of your data in log files are essential for the operation of the website.
If the user requests the deletion of such data or objects to their processing, we will no longer be able to provide access to our website.
V. Use of cookies
1. Description and scope of the processing of personal data
Our website uses cookies. Cookies are text files that are stored in the user's Internet browser or Internet browser system. When a user visits a website, a cookie may be stored on his or her operating system. This cookie contains a string of characters that can be used to clearly identify the user if they visit the website again.
We use cookies to make our website more user-friendly. Some elements of our website require the calling user to be identified even after changing pages.
The following data is stored and transmitted in cookies
The language setting
Items in the shopping cart
Login information
In addition, we use cookies on our website to analyse the browsing behaviour of users.
The following data may therefore also be transmitted
Search criteria entered
Frequency of page opening
Use of the website's features
The user data collected in this way is pseudonymised by technical measures. Therefore, an identification of the calling user is no longer possible. The data will not be stored together with other personal data of the users.
When accessing our website, a banner informs the user of the use of cookies for analysis purposes and his/her consent to the processing of his/her data is expressly obtained by means of an I AGREE checkbox. It is also indicated how the browser can be configured not to allow the storage of cookies.
A link is also provided to this data protection charter.
Link: https://www.grandaquariumdetouraine.com/en/legal-information
2. Legal basis for processing personal data
The legal basis for the processing of personal data with the help of cookies is the user's consent pursuant to Article 6 paragraph 1 point a of the GDPR.
3. Purpose of the processing of personal data
The use of technically necessary cookies is intended to facilitate the use of the websites by users. Some features of our website cannot be offered without the use of cookies. To be able to use them, it is necessary that the browser is recognised even after a page change.
We need cookies for the following applications:
Shopping cart
Transfer of language settings
Storage of search criteria
The user data collected via technically necessary cookies is not used to create user profiles.
The purpose of using analysis cookies is to improve the quality of our website and its content. Through the use of analysis cookies, we learn how our website is used and enable us to continuously optimise our offer.
4. Duration of storage, right of objection and deletion
Cookies are stored for a maximum period of 13 months.
The cookies are stored on the user's computer, from where they are transmitted to us. Therefore, as a user, you have full control over the use of cookies. By changing the settings of your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically.
However, if cookies are deactivated for our website, it may not be possible to use all the functions of the website to their full extent.
VI. Newsletter
1. Description and scope of processing of personal data
On our website, you have the opportunity to subscribe to our free newsletter. When you register for the newsletter, the data in the input mask is transferred to us:
Address data
E-mail address
Date of birth
In addition, the following data is collected during the registration process:
IP address of the calling computer
Date and time of registration
Data processing is permitted with your consent obtained during the registration process, with a link to this data protection policy.
No data will be passed on to third parties in connection with the processing of data for the purpose of sending newsletters. The data will be used exclusively for sending the newsletter.
2. Legal basis for processing personal data
The legal basis for the processing of data after the user has registered for the newsletter is the user's consent in accordance with Article 6 paragraph 1 point a of the GDPR.
3. Purpose of the processing of personal data
The e-mail address and other personal data collected as part of the registration process are used to distribute the newsletter.
4. Duration of storage
The data is deleted as soon as it is no longer necessary for the purpose for which it was collected and in any case for a period of 3 years without any contact being made and in the absence of a request for deletion within this period. The e-mail address and other personal data of the user are therefore stored as long as the subscription to the newsletter is active
5. Right of objection and deletion
The subscription to the newsletter can be cancelled at any time by the user concerned. A link is placed in each newsletter to this effect allowing for unsubscription.
The user may also withdraw his consent and request the deletion of his personal data collected during the registration process.
VII. Registration - Creation of a user account
1. Description and scope of processing of personal data
On our website, when purchasing online, we ask users to register and create a user account by providing personal data. The data is entered into an input mask and then transmitted to us and stored by our partner Digitick. www.digitick/com/dataprotection
No data is transferred to third parties.
The following data is collected during the registration process:
Address data
Name and surname
E-mail address
Date of birth
At the time of registration, the following data is also stored:
IP address of the user
Date and time of registration
The user's consent to the processing of his/her personal data is expressly obtained as part of the registration process.
2. Legal basis for processing personal data
The legal basis for the processing of data is the user's consent, as provided for in Article 6 paragraph 1 point a of the GDPR.
If the registration and the creation of the user account serve the performance of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of data is the performance of the contract provided for in Article 6 (1) (b) of the GDPR.
3. Purpose of processing personal data
User registration is required for the provision of certain content and services on our website:
Retrieving information
Requesting a credit note
Reservation/invoice request.
Contact request
Online purchase
A user's registration is necessary to regularise a contract with him or to implement pre-contractual measures:
Ordering products and services
Reservations of any kind.
4. Duration of storage
The personal data stored are deleted as soon as they are no longer necessary for the purpose for which they were collected:
This is the case for data collected during the registration process and creation of a user account when registration on our site is cancelled or modified.
This is the case for data collected during the process of registration and creation of a user account when the registration on our site is cancelled or modified. It is the case during the regularisation of a contract with the user or to implement pre-contractual measures if the data is no longer necessary for the execution of the said contract or the implementation of the said pre-contractual measures.
After the conclusion of the contract, it may be necessary to retain the user's personal data in order to comply with contractual or legal obligations:
Successive performance contracts
Warranty periods
Tax data retention periods
In any event, data will not be retained for more than 3 years from the date of our last unanswered contact, unless you object or request its deletion in the meantime.
5. Right of objection and deletion
As a user, you have the right to cancel and delete your registration and your user account at any time. You can change your stored data at any time.
The deletion of data can be carried out at any time by logging into your user profile or by sending an email to contact@grandaquariumdetouraine.com
If the data is necessary for the performance of a contract or for the implementation of pre-contractual measures, early deletion of data is only possible if no contractual or legal obligation prohibits it.
The deletion of the user's personal data will prevent the user from receiving products and services that require the processing of such data.
VIII. Contact form and contact by e-mail
1. Description and scope of processing of personal data
A contact form is available on our website which can be used for electronic contact. If a user uses this option, the data entered in the input mask will be transmitted to us and stored. These data are :
First name and surname
Address data
E-mail address
Telephone number
Date of birth
At the time of sending the message, the following data is also stored:
IP address of the user
Date and time of registration
Your consent to the processing of data is obtained during the process of sending your contact request, with a link to this data protection policy.
It is also possible to make contact via the e-mail address. In this case, the user's personal data transmitted by e-mail will be stored.
The data will not be transferred to third parties. The data is used exclusively for processing the communication.
2. Legal basis for processing personal data
The legal basis for the processing of the data is the user's consent pursuant to Article 6 paragraph 1 point a of the GDPR.
The legal basis for the processing of data transmitted when sending an e-mail is also the consent provided for in Article 6 paragraph 1 point a of the GDPR.
If the e-mail contact is for the purpose of concluding a contract, the additional legal basis for the processing is the performance of the contract pursuant to Article 6 paragraph 1 point b of the GDPR.
3. Purpose of the processing of personal data
The processing of personal data from the input mask serves only to respond to your contact request. In the case of contact by e-mail, this also includes the legitimate interest required for data processing.
The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our IT systems.
4. 4. Retention period
Data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of the data mentioned in the input mask of the contact form and those sent by e-mail, this is the case when the communication with the user has ended. The communication is terminated when it can be deduced from the circumstances that a detailed answer has been given to the request made or that the facts have been finally clarified.
5. Right of objection and deletion
The user has the possibility to revoke his consent to the processing of his personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, however, the communication cannot be continued.
The deletion of data can be implemented at any time by sending an email to contact@grandaquariumdetouraine.com
In this case, all personal data stored during the contact will be deleted.
IX. Website analysis
For the purpose of statistical analysis of our website activity, we use analysis tools, which allow us to improve the quality of our website, its content and to optimise our services.
1. Website analysis via Google Analytics with anonymisation function
We use Google Analytics, a web analysis service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereafter referred to as "Google". Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site.
The information generated by the cookie, such as the time, place and frequency of your visit to the website, including your IP address, is transmitted to and stored by Google in the United States.
We use Google Analytics on our website with the extension "_gat._anonymizeIp". In this way, your IP address is processed in an abbreviated form and thus anonymised, excluding any direct identification of the user, in the Member States of the European Union and in the other Contracting States of the Agreement on the European Economic Area.
Google will use this information to evaluate your use of our website, to compile reports on website activity and to provide other services related to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.
Google declares that it will not associate your IP address with any other data it may have collected.
You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.
In addition, Google offers an opt-out module for the most common browsers to better control the data that Google collects on the sites you visit. The add-on informs the Google Analytics JavaScript (ga.js) that no website visit information should be transmitted to Google Analytics. However, the Google Analytics Disable add-on does not prevent information from being transferred to us or to any other web analytics service we may use. For more information on installing the browser disable add-on, see Link.
Alternatively, future analysis of your visit to the site by Google Analytics can be disabled by clicking on the link below. By clicking on the link, an opt-out cookie is created, preventing any 'analysis of your browsing on our website. :
Click here to disable Google Analytics cookies.
Please note that if you delete cookies in your browser settings, the deactivation cookie may also be deleted.
2. Website analysis by YouTube
Our website contains at least one plugin from YouTube, which is owned by Google Inc. located in San Bruno, California, USA. As soon as you visit our website with a YouTube plug-in, you are connected to the YouTube servers. At the same time, the YouTube server will be informed of the particular page of our website that you have visited. If you are also logged into your YouTube account, YouTube allows you to associate your browsing experience directly with your personal profile. You can opt out of this assignment if you first log out of your account. For more information on the collection and use of your data via YouTube, see their privacy policy at www.youtube.com.
3. Website analysis by Facebook Pixel
Our website uses the remarketing feature "Custom Audiences" of Facebook Inc. ("Facebook"). This function serves to present ("Facebook ads") to visitors of this website in the context of their visit to the social network Facebook interest-based advertisements. For this purpose, the Facebook remarketing tag has been installed on our website. This tag establishes a direct connection to the Facebook servers when you visit the site. The information that you have visited our website is transmitted to the Facebook server and Facebook assigns this information to your personal Facebook user account. For more information on the collection and use of data by Facebook, your rights in this regard and how you can protect your privacy, see the Facebook privacy policy at www.facebook.com/about/privacy/. You can also deactivate the remarketing function "Custom Audiences" at www.facebook.com/settings/. To do so, you must be logged in to Facebook.
4. Use of web fonts
A JavaScript code is loaded on our website. If you have activated JavaScript in your browser but have not installed a JavaScript blocker, your browser may transmit personal data. We do not know which data is linked with the received data and for what purpose this data is used. To prevent the execution of JavaScript code in general, you can install a JavaScript blocker (e.g. www.noscript.net).
The following fonts are used on our website: Google Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043 USA (further information in the Google privacy statement).
X. Recipients of users' personal data
1. The personal data of users is processed primarily by our internal departments and employees.
2. However, your personal data may be transferred to other recipients who provide us with services in connection with our website, such as our IT service providers in connection with the administration and hosting of our website, our external service providers in charge of processing applications or organising competitions, our logistics service providers, our insurance companies in case of claims.
In this case, we limit the transfer of your data to what is strictly necessary.
Our service providers receive your data as subcontractors and are strictly bound by our instructions regarding the processing of your data.
We also ensure that they implement all appropriate confidentiality and security measures to protect the data transmitted to the best of their ability.
3. In the context of the use of statistical analysis tools of the activity of our website, personal data of the user limited to the IP address, are transferred to the USA to entities that have adhered to the Privacy shield, an agreement regularised with the EU Commission considering the level of protection granted as adequate (implementing decision 2016/1250 of 12 July 2016).
XI. Rights of the data subject
As a data subject, you have the following rights, which can be exercised at the following e-mail address: contact@grandaquariumdetouraine.com
1. Right of access
You may, at any time, request confirmation as to whether or not your personal data are being processed.
You are also entitled to request the following information
the purposes for which personal data are processed ;
the categories of personal data processed; and
the recipients or categories of recipients to whom the personal data have been or will be disclosed;
the period for which the personal data are to be kept or, where this is not possible, the criteria used to determine that period;
where personal data are not obtained from the data subject, any available information as to their source;
the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, and at least in such cases, relevant information concerning the underlying logic and the significance and intended consequences of such processing for the data subject.
The possible transfer of personal data to a third country or an international organisation. In this context, you may request to be informed of the appropriate safeguards under Article 46 of the GDPR. We will reply within 1 month.
This right of access may be restricted if it would prevent or seriously hamper the performance of research or statistics and if such restriction is necessary for their proper performance.
2. Right of rectification
You are entitled to request that your personal data be corrected or completed if they are incomplete or inaccurate.
This right of rectification may be restricted if it would prevent or seriously hamper the performance of research or statistics and if this restriction is necessary for their proper performance.
3. Right to limit processing
You may obtain the restriction of the processing of your personal data under the following conditions
you contest the accuracy of the personal data and request the limitation for a period of time allowing the data controller to verify their accuracy;
the processing is unlawful and you refuse the erasure of your personal data and instead request the restriction of their use;
the Controller no longer needs the personal data for the purposes of the processing, but they are still necessary for the establishment, exercise or defence of legal claims,
you have objected to the processing in accordance with Article 21(1) of the GDPR, but it has not yet been established whether the legitimate interests of the Controller prevail over yours.
Where the processing of your personal data has been restricted, such data may, with the exception of storage, only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or on important Union or Member State public interest grounds.
If the processing of personal data has been restricted in accordance with the above conditions, you will be informed by the Controller before the restriction of processing is lifted.
This right to restrict processing may be restricted if it would prevent or seriously hamper the performance of research or statistics and if such restriction is necessary for their proper performance.
4. Right to erasure
a) Obligation to erase
You have the right to have your personal data deleted as soon as possible. The controller is also obliged to delete such data, if one of the following reasons applies
the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
you withdraw your consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR and there is no other legal basis for the processing;
you object to the processing pursuant to Article 21(1) of the GDPR and there is no compelling legitimate reason for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR;
the personal data have been processed unlawfully;
the personal data must be erased in order to comply with a legal obligation laid down by Union law or by the law of the Member State to which the controller is subject;
your personal data have been collected in connection with the services offered by an information society in accordance with Article 8(1) of the GDPR.
b) Information to third parties
Where the Controller has made personal data about you public and is required to erase it under Article 17(1) of the GDPR, the Controller must take reasonable steps, taking into account the available technology and the costs of implementation, including technical measures, to inform the controllers processing such personal data that you, as the data subject, have requested the erasure of all links to, or copies or reproductions of, such data.
c) Exceptions
The right to erasure does not exist where processing is necessary :
to exercise the right to freedom of opinion and information ;
to comply with a legal obligation or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller and requiring processing under Member State or Union law;
for public interest purposes in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89 (1) of the GDPR, insofar as the law referred to in subparagraph a) is likely to make it impossible or seriously affect the achievement of the purposes of such processing;
for the establishment, exercise or defence of legal claims.
5. Right to information
If you have exercised your right to rectification, erasure or restriction of processing with the Data Controller, the latter is obliged to inform all recipients to whom your personal data have been disclosed of such rectification, erasure or restriction of data processing, unless this proves impossible or involves a disproportionate effort.
You have the right to request information about these recipients.
6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the Controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another Controller without the Controller to whom the personal data has been communicated having any objections, when :
the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
the processing is carried out using automated processes.
When exercising your right to data portability, you also have the right to have your personal data transferred directly from one Responsible Entity to another, where technically possible. This must not, however, affect the rights and freedoms of other persons.
The exercise of the right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority vested in the Data Controller.
7. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the legitimate interest or a task in the public interest in accordance with Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.
We must then cease processing your personal data, unless there are compelling legitimate grounds for the processing which override your interests and rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data are processed for the purpose of canvassing, you have the right to object at any time to the processing of your personal data for such canvassing purposes, including profiling insofar as it is related to such canvassing.
If you object to the processing for marketing purposes, the personal data shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the possibility to exercise your right to object by means of automated processes using technical specifications.
Where personal data are processed for scientific or historical research or statistical purposes pursuant to Article 89(1) of the GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of such data.
This right of objection may be restricted if it would prevent or seriously hamper the performance of research or statistics and if such restriction is necessary for their proper performance.
8. Right to revoke the declaration of consent
You have the right to revoke your declaration of consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
9. Automated individual decision making, including profiling
You have the right not to be subject to a decision based exclusively on automated processing, including profiling, which produces legal effects concerning you or which significantly affects you in a similar way.
This does not apply if the decision:
(1) is necessary for the conclusion or performance of a contract between the data subject and the Controller,
(2) is authorised by Union law or the law of the Member State to which the Controller is subject and which also provides for appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject
(3) is based on your explicit consent.
However, such decisions shall not be based on special categories of personal data under Article 9 (1) of the GDPR, unless Article 9 (2) of the GDPR applies and reasonable steps have been taken to safeguard the rights and freedoms and your legitimate interests.
With regard to the cases referred to in points (1) and (3), the Responsible Entity shall take appropriate measures to uphold your rights and freedoms as well as your legitimate interests, including at least allowing you to express your point of view and to contest the decision.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are normally resident, work or where the breach occurred, if you consider that the processing of your personal data constitutes a breach of the GDPR.
However, you always have the possibility to lodge your complaint with the Data Controller at contact@granaquariumdetouraine.com, who will reply within two months.
The supervisory authority to which the complaint has been submitted will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.
In France, the supervisory authority is the CNIL, 3 place de Fontenoy, 75007 Paris, tel 01 53 73 22 22
