Privacy Policy

Data controller

Numenor Group LLC, 188 Grand Street, Unit 343, New York, NY 10013, États-Unis. Contact routes are listed in the legal notice.

What we collect

• Account: email address, first and last name, password (stored hashed, never in clear), display language and currency.
• Booking: experience, date, time slot, language, number and identity of travellers, details required by the experience (age, health constraints, height for equipment), amount, currency, voucher.
• Payment: card details go directly to the payment provider and never pass through our servers. We keep the amount, the currency, the payment status and a reference.
• Messages: exchanges with a supplier or with support, attached to the booking concerned.
• Proof of consent: the purpose accepted or refused, the date, the version of the register, and — so that the proof is actually one — the IP address and user agent at the moment of the choice.
• Fraud prevention: technical and behavioural signals assessed at order time (volume, account age, consistency of the information).
• Technical logs needed for security and diagnostics.

Why, and on what basis

• Delivering the booking and after-sales support — performance of the contract.
• Collecting and refunding payments, accounting, tax and platform reporting obligations — legal obligation.
• Preventing fraud and securing accounts — legitimate interest.
• Audience measurement and remembering display preferences — consent, refused by default (see the cookie policy).

What the supplier receives

The supplier receives what it needs in order to deliver: the experience booked, the date and time slot, the language, the number and identity of travellers, and the details it declared necessary on its listing.

It never receives your real email address. Messages travel through a relay address specific to the booking: you can be reached without your address being disclosed, and the relay ends with the booking. Nor does the supplier receive your payment data.

Other recipients

The payment service provider, the infrastructure host, and the transactional email service, each for its own part only. No data is sold, rented or passed on for advertising purposes.

Transfers outside the European Union

Numenor Group LLC is established in the United States, so data is processed outside the Union. Those transfers rely on the appropriate safeguards of Chapter V of the GDPR, in particular the European Commission's standard contractual clauses with the processors concerned.

How long

• Account: until you delete it.
• Bookings, payments, refunds: kept for as long as applicable accounting and tax obligations require, including after the account is deleted.
• Fraud assessments: 180 days.
• Audience measurement, search history, operational logs: 90 days.
• Proof of consent: kept for as long as it may be required as proof.

Your rights, exercisable right now

From your account → Site preferences, with no need to write to us or wait:

• Export all of your data as a readable file;
• Request erasure of your account and of the data not held back by a legal obligation;
• Withdraw a consent, purpose by purpose.

The rights of access, rectification, restriction and objection are exercised through the contact routes in the legal notice. You may also lodge a complaint with the data protection authority of your country of residence.

Security

Access is authenticated and partitioned by role, passwords are stored hashed, communications are encrypted in transit, and sensitive actions are logged.

Minors

The service is not intended for people under sixteen. A minor may take part in an activity as a traveller declared by the adult who makes the booking.