Privacy policy

1. Data controller

The data controller is EI BOUYSSETGROUP (Escale France), 7 lot Haut Terrier, 33220 Saint-Avit-Saint-Nazaire, France. For any question about your data, write to contact@escalefrance.com.

This policy describes how we collect and process your data in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French Data Protection Act.

2. Data we collect

We collect:

• the account data you provide (first name, last name, e-mail, country, password, optional profile photo and bio);
• the content you publish (reviews, ratings, photos, favourites, itineraries);
• usage and technical data (pages viewed, language preferences, IP address, device and browser type, cookie identifiers);
• the information you send when you contact us.

3. Purposes and legal bases

Your data is processed for the following purposes:

• providing and managing your account and the services (legal basis: performance of the contract);
• publishing and moderating reviews, calculating the Escore and rankings (legal basis: performance of the contract and legitimate interest);
• improving and securing the Platform, preventing fraud and abuse (legal basis: legitimate interest);
• sending you communications or a newsletter (legal basis: your consent);
• complying with our legal obligations (legal basis: legal obligation).

4. Recipients and processors

Your data is never sold. It is accessible to our authorised staff and to our technical processors acting on our behalf, in particular:

• our host Hostinger International Ltd;
• our audience measurement and content providers (e.g. encyclopaedic sources for photos and descriptions).

These providers are bound by confidentiality and GDPR compliance commitments. Your data may also be disclosed to the authorities where required by law.

5. Transfers outside the EU

Your data is hosted within the European Union. Where a transfer to a third country is necessary, it is only carried out to countries recognised as providing an adequate level of protection or under appropriate safeguards (the European Commission's standard contractual clauses).

6. Retention periods

We retain your data:

• account data: for as long as your account is active, then deleted or anonymised within a reasonable period after its closure;
• reviews and contributions: they may be kept in anonymised form for the continuity of the rankings;
• technical and connection data: in accordance with the applicable legal periods;
• consent-related data (newsletter): until you withdraw your consent.

7. Cookies and trackers

The Platform uses the following cookies and trackers, listed in full below.

Strictly necessary cookies (always active, exempt from consent):

• PHPSESSID — keeps your session (sign-in state, lists in progress, anti-CSRF security tokens, messages). Duration: for the session (deleted when the browser closes).
• ef_oauth_next — remembers the return page during a Google sign-in. Duration: 10 minutes.
• g_csrf_token — set by Google to secure the “Sign in with Google” button (anti-CSRF protection). Duration: for the sign-in.

Audience measurement cookies (subject to your consent, via Google Analytics 4):

• _ga — distinguishes visitors to compile traffic statistics. Duration: 13 months.
• _ga_7WKW0JQS4J — stores the session state for Google Analytics 4. Duration: 13 months.
• _gid — distinguishes visitors. Duration: 24 hours.

Preferences stored locally on your device (local storage; these are not cookies and nothing is sent to our servers):

• ef_a11y_v1 — your accessibility settings (text size, contrast, tint, color vision, etc.).
• ef_circuit_v1 — your “Circuit” itinerary saved on the device.

Non-essential cookies are only set with your consent. You may withdraw or change your choices at any time from your browser settings, or opt out of audience measurement using Google's add-on: https://tools.google.com/dlpage/gaoptout

8. Your rights

In accordance with the GDPR, you have the following rights: the right of access, rectification, erasure, restriction, objection, and portability of your data, as well as the right to withdraw your consent at any time and to set instructions regarding the fate of your data after your death.

To exercise these rights, write to contact@escalefrance.com. You also have the right to lodge a complaint with the supervisory authority (in France, the CNIL): https://www.cnil.fr

9. Security

We implement appropriate technical and organisational measures (encryption of communications, access control, secure hosting in the EU) to protect your data against any unauthorised access, alteration or disclosure.

10. Minors

The Platform is not intended for children under 15. We do not knowingly collect data concerning minors under 15 without the consent of the holder of parental authority. Where applicable, such data will be deleted.

11. Changes

This privacy policy may be updated to reflect changes in our services or in regulations. Any substantial change will be brought to your attention. The date of the last update appears at the top of this page.