PRIVACY POLICY
https://lelouvre-billetterie.com/
Hereinafter, the "Controller".
BeTraveller OÜ is responsible for the processing of personal data collected through the Website.
Data processing is carried out in accordance with:
3.1 Booking and purchase management
Includes: Order management, Payment processing, Ticket issuance and delivery, After-sales support, Communication with tourism providers.
Legal basis: Performance of a contract (Art. 6.1.b GDPR)
3.2 Customer service and inquiries
Management of requests sent through forms or email.
Legal basis: Consent (Art. 6.1.a GDPR) or pre-contractual measures.
3.3 Fraud prevention and security
Data processing for: Detection of fraudulent transactions, Prevention of misuse, System protection.
Legal basis: Legitimate interest (Art. 6.1.f GDPR)
3.4 Sending own commercial communications
Information about similar products or services.
Legal basis: Consent (Art. 6.1.a GDPR), or Legitimate interest in the case of existing customers (Art. 6.1.f GDPR). The User may object at any time via the unsubscribe link included in each communication.
3.5 Statistical analysis and Website improvement
Use of analytics tools to improve the user experience.
Legal basis: Consent (when required) or legitimate interest.
The following categories may be processed:
No special categories of data are processed (Art. 9 GDPR).
The data requested to complete a purchase is mandatory. Refusal to provide it will prevent the provision of the service.
Data will be retained for the following periods:
Afterwards, data will be blocked and deleted in accordance with current regulations.
Data may be disclosed to:
7.1 Essential service providers: Tourism providers, Payment gateways, Technology providers, Web hosting services. They act as data processors under contract in accordance with Art. 28 GDPR.
7.2 Public authorities: When a legal obligation exists.
Personal data is not sold to third parties.
Some technology providers may be located outside the European Economic Area. In such cases, Standard Contractual Clauses approved by the European Commission will apply and additional security measures will be adopted where appropriate.
BeTraveller OÜ may use automated systems for fraud detection and statistical analysis. No automated decisions that produce significant legal effects for the User are made within the meaning of Article 22 GDPR.
The Website is not directed at persons under 18 years of age. We do not deliberately collect data from minors without the authorization of their legal representatives.
The User may exercise the following rights: Access, Rectification, Erasure, Restriction of processing, Portability, Objection, Withdrawal of consent.
To exercise them, you may write to: [email protected]
If you believe your rights have not been respected, you may file a complaint with the Andmekaitse Inspektsioon (Estonian Data Protection Authority): https://www.aki.ee
You may also contact the data protection authority of your country of residence within the European Union.
BeTraveller OÜ applies appropriate technical and organizational measures to ensure: SSL encryption in communications, Use of secure payment gateways, Restricted access control, Protection against unauthorized access.
The Website uses first-party and third-party cookies. For more information about the use of cookies, configuration and consent withdrawal, please see our Cookie Policy.
BeTraveller OÜ may update this Policy to adapt it to regulatory or technical changes. The current version will always be available on the Website.
BeTraveller OÜ maintains a Record of Processing Activities in accordance with Article 30 of the GDPR, documenting the categories of data processed, purposes, recipients, international transfers and security measures applied.
For each processing purpose described in section 3, BeTraveller OÜ has identified and documented the applicable legal basis in accordance with Article 6 of the GDPR, as detailed in that section.
When deletion is applicable, data will be blocked and retained exclusively at the disposal of competent authorities during the applicable legal limitation periods, after which they will be permanently deleted.
BeTraveller OÜ does not carry out invasive commercial profiling or automated decisions with legal effects based on the User's personal preferences.
The automated systems used are limited to:
Requests should be sent to: [email protected]
The request must include:
The Controller will respond within a maximum period of one month, in accordance with Art. 12 GDPR.
Without prejudice to the right to contact the competent supervisory authority, the User may use alternative dispute resolution mechanisms available in the European Union where applicable.
This Policy shall be governed by the law of the Republic of Estonia and by Regulation (EU) 2016/679 (GDPR).
When data processing is based on the legitimate interest of BeTraveller OÜ (for example, fraud prevention, system security or sending communications to existing customers), a corresponding balancing assessment has been carried out, ensuring that such interests do not override the fundamental rights and freedoms of the User.
The User may object at any time to processing based on legitimate interest by sending a request to [email protected].
BeTraveller OÜ is not required to appoint a Data Protection Officer in accordance with Article 37 of the GDPR, as it does not carry out processing that requires one by its nature, scope or purpose.
The User guarantees that the personal data provided is truthful, accurate and up to date. The User undertakes to communicate any changes thereto.
BeTraveller OÜ shall not be liable for any damages arising from the inaccuracy or lack of updating of the data provided.
Regardless of the ordinary retention periods indicated above, BeTraveller OÜ may retain certain personal data, duly blocked, when necessary for:
This data will remain blocked during the applicable legal limitation periods and will be permanently deleted once such periods have elapsed.
In the event of a merger, acquisition, corporate restructuring, asset transfer or any corporate operation involving the transfer of the business or part thereof, personal data may be disclosed to the resulting or acquiring entity, always ensuring:
The User will be informed when such disclosure materially affects their rights.
BeTraveller OÜ adopts appropriate technical and organizational measures to protect personal data. However, it cannot guarantee the absolute invulnerability of technological systems against unlawful access, cyberattacks or other acts carried out by third parties beyond its reasonable control.
In the event of a security breach that poses a risk to the rights and freedoms of the User, action will be taken in accordance with Articles 33 and 34 of the GDPR.
This Privacy Policy should be read in conjunction with the Website's Terms and Conditions. BeTraveller OÜ acts as an intermediary in the marketing of tourist activities, without prejudice to its status as Data Controller with respect to personal data collected through the Website.
In certain cases, BeTraveller OÜ may receive personal data from third-party providers linked to the provision of the contracted service (for example, tourism providers or payment platforms).
In such cases, said data will be processed exclusively for the proper performance of the contract and in accordance with this Privacy Policy.
The tourism providers that ultimately deliver the contracted activity may process certain personal data of the User as independent data controllers, in accordance with their own privacy policies.
BeTraveller OÜ shall not be liable for the processing carried out directly by such providers once the data has been disclosed for the proper provision of the service.
Certain communications related to purchase management, confirmations, modifications, incidents or relevant information about the contracted activity are mandatory and cannot be cancelled while an active contractual relationship exists.