Privacy Policy

This privacy policy applies to the marchesgourmandes.fr platform, accessible at https://www.marchesgourmandes.fr, published by:

Digitalways SARL 91 route des Romains, 67200 STRASBOURG, France SIRET: 914 809 645 00023

Data Protection Officer (DPO): Guillaume SPONY Contact: contact@digitalways.fr

User account data

• First name, last name — identification and named tickets (contract performance)
• Email address — account and transactional communications (contract performance)
• Hashed password — authentication (contract performance)
• Role (organizer, participant) — access and permission management (contract performance)

Organizer data

• Association name — legal identification and public display (contract performance)
• Address, SIRET — Stripe KYB verification and invoicing (legal obligation)
• Contact details — communication and display on events (contract performance)
• Banking data (via Stripe) — fund transfer (contract performance)

Banking data is collected and processed exclusively by Stripe. Digitalways has no access to it.

Participant data

• First name, last name — named tickets, booking management (contract performance)
• Email address — confirmation, reminders, communications (contract performance)
• Menu choice — logistical preparation by the organizer (contract performance)
• Followed department (alerts) — notifications of new walks (consent)

Payment data

Payments are processed by Stripe. Digitalways does not collect, store or process any banking data (card number, expiration date, CVV). See Stripe's privacy policy: https://stripe.com/privacy

When booking, participants may select a menu variation from those offered by the organizer (e.g., vegetarian, gluten-free, etc.). This choice constitutes a consumption preference linked to the order and is not health data within the meaning of the GDPR (Article 9). It does not reveal a health condition but expresses a choice among the options proposed for the event.

• Legal basis: contract performance (the menu choice is part of the order).
• Access: only the organizer of the relevant event and the platform super administrator.
• Purpose: logistical preparation of the event (planning, catering).
• This data is never shared with third parties for commercial purposes.

• Event organizer — first name, last name, email, price, time slot, menu choice (event management)
• Stripe — payment data (transaction processing)
• Vercel — technical data, logs, IP (hosting)
• Mailjet — email, first name, last name (transactional emails)
• Google (Google Maps API) — IP address, geolocation data (map display)
• Google (Analytics, GTM) — anonymized browsing data (audience measurement, subject to consent)
• Google (Ads, DoubleClick) — advertising identifiers, browsing data (advertising and conversion tracking, subject to consent)
• Meta (Facebook, Instagram) — advertising identifiers, social interactions (share buttons, embedded content, ad targeting, subject to consent)

No personal data is sold, rented or transferred to third parties for commercial purposes. Data transmitted to advertising and social media services is only shared if the user has given consent via the cookie banner.

• Active user account — duration of service use
• Inactive account — deletion after 3 years of inactivity (CNIL recommendation), after prior notification by email
• Deleted account — deletion within 30 days, except for legal obligations
• Transaction data — 10 years (accounting obligation)
• Menu choices — deleted 3 months after the event date
• Technical logs — 12 months

In accordance with the GDPR, you have the following rights:

• Access — obtain a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data
• Restriction — restrict the processing of your data
• Portability — receive your data in a structured format
• Objection — object to the processing of your data
• Withdrawal of consent — withdraw your consent at any time (geographic alerts)

To exercise these rights, contact us at: contact@digitalways.fr

You may also lodge a complaint with the CNIL (French Data Protection Authority): https://www.cnil.fr

Some subprocessors (Stripe, Vercel) may transfer data outside the European Union. These transfers are governed by:

• European Commission standard contractual clauses.
• The Data Privacy Framework (DPF) for transfers to the United States.

Digitalways implements appropriate technical and organizational measures to protect personal data:

• Communications encryption (HTTPS/TLS).
• Password hashing.
• Role-based access control.
• Participant data access restricted to the relevant organizers.

Digitalways reserves the right to modify this policy. Users will be informed by email of any substantial modification. The last updated date is shown at the top of the document.

For any question related to the protection of your data:

Guillaume SPONY — DPO Digitalways SARL 91 route des Romains, 67200 STRASBOURG Email: contact@digitalways.fr