Privacy policy
How we collect, use and protect your personal data. Compliant with the EU General Data Protection Regulation (GDPR).
Data controller
The data controller is Croisière Agriates, Port de Saint-Florent, ponton E, 20217 Saint-Florent, Haute-Corse, France. Contact: croisiere.saint.florent@gmail.com.
What data we collect
- Contact form: first name, last name, email, phone (optional), message — kept 3 years from last contact.
- Booking form: first name, last name, email, phone, accommodation (optional), dietary restrictions, cruise details — kept 10 years for accounting.
- Server logs: IP address, user agent — kept 12 months for security and anti-abuse purposes.
- Analytics cookies: only set after your explicit consent via the cookie banner (opt-in strict).
Cookies used
Our site applies a strict opt-in policy aligned with European standards: no analytics cookie is set without your explicit consent. You can change your choice at any time via the "Cookie preferences" button in the footer.
| Cookie | Purpose | Duration | Consent |
|---|---|---|---|
cga_consent | Stores your cookie consent preferences | 13 months | Necessary |
_ga, _ga_XXXX | Google Analytics 4 (anonymised IP, Consent Mode v2) | 13 months | After consent |
| PHP session | Anti-spam and form rate limiting | Session | Necessary |
No advertising, profiling or social media cookies are set on this site.
Why we process your data
- To respond to your enquiry or booking request (legal basis: performance of a contract or pre-contract)
- To send transactional emails (confirmations, reminders)
- To comply with legal and accounting obligations
- To prevent abuse (spam, rate limiting) — legitimate interest
Who has access to your data
Your data is processed exclusively by the Croisière Agriates team. Our technical subprocessors are:
- O2Switch — hosting in France (EU)
- SMTP provider — for transactional email delivery
- Google reCAPTCHA v3 — anti-spam protection on contact and booking forms. Google collects technical data (IP address, mouse interactions, browser fingerprint) to score each submission and distinguish humans from bots. Use is governed by the Google Privacy Policy and Terms of Service.
Except for the reCAPTCHA processing above (Google, USA — under Standard Contractual Clauses), no data is transferred outside the European Union.
Your rights
Under GDPR you have the right to:
- Access your data
- Rectify incorrect data
- Delete your data (right to be forgotten)
- Restrict processing
- Data portability
- Object to processing based on legitimate interest
To exercise any of these rights, email us at croisiere.saint.florent@gmail.com — we reply within 30 days.
You can also file a complaint with the French data protection authority (CNIL): www.cnil.fr.