Privacy Policy
How we collect, use and protect your personal data.
Foreword
SYLLA VOYAGES attaches particular importance to your privacy and the protection of your personal data. This privacy policy informs you about how we collect, use and protect your data, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (« GDPR ») and the French Data Protection Act of 6 January 1978.
Data controller
The data controller is: SYLLA VOYAGES (SARL, share capital €10,000) 4 avenue Sisley, 92150 Suresnes, France SIRET: 102 666 377 00019 Nanterre Companies Register: 102 666 377 Contact for data protection matters: contact@sylla-voyages.com SYLLA VOYAGES has not appointed a Data Protection Officer (DPO), as this designation is not mandatory given the nature of our activities and the processing carried out.
Data we collect
We collect only the data strictly necessary for the purposes described below: • Identification data: name, surname, email address, phone number • Travel project data: destination(s), dates, number of travellers, indicative budget, preferences (accommodation, experiences, themes), free comments • Booking data (upon confirmation): identity documents, dates of birth, information relating to accompanying minors • Payment data: handled by our secure payment providers — SYLLA VOYAGES never stores your bank details • Browsing data: IP address, browser type, pages visited (only after your consent for audience measurement — see Cookie Policy)
Purposes and legal bases
Your data is processed for the following purposes: • Drafting quotes and personalised travel proposals — legal basis: pre-contractual measures at your request (art. 6.1.b GDPR) • Managing your booking, executing the travel contract, customer relationship — legal basis: performance of contract (art. 6.1.b GDPR) • Replying to your contact and information requests — legal basis: legitimate interest (art. 6.1.f GDPR) • Sending commercial communications (newsletter, offers) — legal basis: consent (art. 6.1.a GDPR), withdrawable at any time via the unsubscribe link in each message • Complying with our accounting and tax obligations — legal basis: legal obligation (art. 6.1.c GDPR) • Improving our services (audience measurement, technical monitoring) — legal basis: consent for audience measurement, legitimate interest for anonymised technical monitoring • Prevention and management of disputes — legal basis: legitimate interest
Retention periods
Your data is retained for the following periods: • Prospect data (unconverted quotes): 3 years from last contact • Contractual data (booked travel): 5 years from the end of the service, in accordance with applicable commercial contract limitation periods • Accounting data (invoices, supporting documents): 10 years, in accordance with art. L.123-22 of the French Commercial Code • Newsletter data: until consent is withdrawn, then 3 years for evidence purposes • Audience-measurement cookies: 13 months maximum • Technical logs (Sentry): 30 days Beyond these periods, your data is deleted or securely archived.
Recipients and sub-processors
Your data may be transmitted, strictly to the extent necessary, to the following recipients: • Our travel providers (accommodation, transport, local guides) — only the data necessary for the execution of your trip • Our technical sub-processors: – Vercel Inc. (United States): website hosting – Render Services Inc. (Germany): backend hosting – Supabase Inc. (European Union): database and file storage – Resend Inc. (United States): transactional email delivery – Functional Software Inc. / Sentry GmbH (Germany): technical error monitoring – Google Ireland Ltd: audience measurement (only after consent) – Cal.com Inc.: appointment booking (only if used) • Public and administrative authorities, upon legal request All our sub-processors are bound by a data processing agreement in compliance with article 28 GDPR.
Transfers outside the European Union
As some of our sub-processors are established in the United States (Vercel, Resend, Cal.com), transfers of data outside the European Union may occur. These transfers are covered by: • The EU-US Data Privacy Framework (DPF), where the sub-processor is certified • Standard Contractual Clauses adopted by the European Commission (decision 2021/914), for sub-processors not covered by the DPF Data processed by Render and Sentry is hosted in data centers located within the European Union (Germany).
Your rights
Under the GDPR, you have the following rights regarding your personal data: • Right of access — obtain a copy of your data • Right to rectification — correct inaccurate data • Right to erasure (« right to be forgotten ») • Right to restriction of processing • Right to object to processing, notably for direct marketing purposes • Right to data portability • Right to withdraw consent at any time (without retroactive effect) • Right to give post-mortem directives regarding your data To exercise these rights, contact us at contact@sylla-voyages.com with proof of identity. We will respond within a maximum of one month.
Complaint to the CNIL
If you consider, after contacting us, that your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL): CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France Website: https://www.cnil.fr Phone: +33 1 53 73 22 22
Security
SYLLA VOYAGES implements appropriate technical and organisational measures to ensure the security of your data: encrypted communications (HTTPS/TLS), database access control, regular backups, logging of access to sensitive data, regular updates of technical components.
Cookies and trackers
The website uses cookies and other trackers. For details of trackers used, their purpose and duration, see our Cookie Policy (/cookies). You may change your preferences at any time via the consent banner.
Updates to this policy
This policy may evolve to reflect changes in our practices, tools or applicable regulations. The last update date is shown at the top of the page. In case of a substantial change, you will be informed by appropriate means.