Privacy and Data Protection Policy

1. Purpose of the Policy

EPIC Les Arcs Bourg Saint Maurice Tourisme places particular importance on protecting your personal data and respecting your privacy.
The purpose of this policy is to provide you with clear, transparent, and understandable information about the processing of personal data carried out in connection with the use of the websites, digital services, apps, tourist activities, and services offered by Les Arcs.
It applies in particular to: requests for tourist information; reservations and sales of activities; parking reservations and subscriptions; the HERO pass; public and professional events; contact forms and complaints; areas dedicated to property owners and rental companies; newsletters and electronic communications; applications for job openings…
It informs you about:

• the data collected;
• the purposes of data processing;
• the legal bases used;
• the recipients of the data;
• retention periods;
• your rights and how to exercise them.

2. Data Controller

Personal data collected in connection with the services offered on the website www.lesarcs.com is processed by:
EPIC Les Arcs Bourg Saint Maurice Tourisme
, 35 rue de la Gentiane
, 73700 BOURG SAINT MAURICE
Depending on the services involved, certain processing activities may be carried out by service providers acting on behalf of EPIC in compliance with applicable regulations.

3. Data Protection Officer (DPO)

For any questions regarding the protection of your personal data or to exercise your rights:
Data Protection Officer (DPO): dpo@lesarcs.com
EPIC Les Arcs Bourg Saint Maurice Tourisme
Attn: DPO
35 rue de la Gentiane
73700 BOURG SAINT MAURICE

4. Your Rights

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• the right to access your data;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to object;
• the right to data portability, where applicable;
• the right to withdraw your consent at any time when processing is based on consent;
• the right to provide instructions regarding the handling of your data after your death.

You may exercise these rights:

• by email at dpo@lesarcs.com;
• via the contact forms available on our websites;
• by mail addressed to the DPO.

If you believe your rights have not been respected, you may file a complaint with the French Data Protection Authority (CNIL): www.cnil.fr.

5. What data do we collect?

Depending on the services you use, we may collect the following:

• Identification data: last name, first name, mailing address, email address, phone number.
• Data related to your requests and reservations: requests for information, reservations or registrations, complaints, communications with our services, participation in events or activities.
• Browsing data: IP address, login credentials, browser type, operating system, website usage data, technical logs, information regarding cookies and other trackers.
• Data regarding property owners and partners: administrative information, business contact information, data regarding accommodations or activities offered.
• Recruitment data (in connection with a job application): resume, cover letter, information regarding professional background and qualifications.

Data marked as required at the time of collection is necessary to process your request.

6. In what circumstances is your data collected?

We collect your data, in particular, when:

• you fill out a contact form;
• you request tourist information;
• you download a brochure;
• you subscribe to a newsletter;
• you create a user account;
• you purchase an activity or a subscription;
• you make a reservation or request a service;
• you use the owner’s portal;
• you apply for a job opening;
• you browse our websites.

7. Purposes of Data Processing and Legal Bases

8. Electronic Communications and Newsletters

When you subscribe to our newsletters or agree to receive our communications, we use the Braze platform to: manage our mailing lists; administer subscriptions and unsubscriptions; send informational and promotional campaigns; track message open rates; track clicks on the content provided; analyze campaign effectiveness; improve the relevance of the content we send.
You may withdraw your consent at any time via the unsubscribe link included in each communication or by contacting the DPO.

9. Retention Periods

Data is retained for no longer than is necessary to fulfill the intended purposes.
For informational purposes:

At the end of these periods, the data is deleted or anonymized.

10. Recipients of the Data

Personal data is accessible only to authorized individuals within the scope of their duties.
Internal departments: tourist information; marketing; events; communications; customer relations; human resources; IT; management and administration.
Service providers and subcontractors:

• Absolu (Drupal Commerce): management of the lesarcs.com website; user accounts; online sales; contact forms; complaints; event registrations; area for property owners and renters; management of certain parking subscriptions.
• YoPlanning: sales and reservations for winter activities; reservations for HERO activities in the summer.
• Team Axess: on-site sales of activities; sales of the HERO Pass; access control for HERO activities.
• Q-Park: seasonal parking passes; pass reservations; short-term parking reservations.
• Coq Trotteur: management of information requests made at the visitor centers.
• Apidae: Management of tourism and socio-professional partners.
• Eficeo: • Conducting satisfaction surveys; measuring the quality of tourism services; analyzing visitor feedback; generating statistics and activity metrics; contributing to the improvement of services and the customer experience.
• Braze: Management of newsletters and information campaigns. 
• Matomo: Audience measurement and statistical analysis of website traffic.
• Google Analytics: audience measurement and statistical analysis of website traffic, when used.

Data may also be disclosed to the relevant authorities when required by law.
All of these service providers are subject to contractual obligations ensuring data confidentiality and security.

11. Data Transfers Outside the European Union

Data is primarily hosted and processed within the European Union.
When certain tools or service providers involve processing outside the European Union, the safeguards provided by applicable regulations are implemented to ensure an adequate level of protection for personal data.

12. Data Security

EPIC Les Arcs Bourg Saint Maurice Tourisme implements appropriate technical and organizational measures to ensure the confidentiality, integrity, availability, and protection of the personal data processed.

13. Cookies and Other Trackers

When you browse our websites, cookies and other similar technologies may be stored on your device (computer, tablet, or smartphone).
These technologies enable us, in particular, to ensure the proper functioning of the site, measure its traffic, improve the services offered, and evaluate the effectiveness of our communication efforts.
Strictly Necessary
Cookies Certain cookies are essential for the website to function properly and cannot be disabled. They enable, in particular:

• The website to function;
• secure browsing;
• session management;
• to remember certain technical preferences;
• access to certain essential website features.
   

Audience
measurement cookies We use audience measurement tools to better understand traffic to our websites and improve their content (Matomo and Google Analytics)
. These tools allow us to obtain traffic statistics such as:

• the number of visitors; 
• pages viewed; 
• navigation paths; 
• the devices used; 
• traffic sources; 
• site performance.
   

The data collected is primarily used for statistical purposes and to improve the user experience.
Communications and newsletters
Communications sent via Braze may include technologies that measure:

• message opens;
• clicks on links;
• interest in the content provided.
   

Managing Your Preferences
During your first visit, a consent management module allows you to:

• accept cookies;
• to reject them;
• to customize your choices.
   

You can change your preferences at any time on the site.

14. Data Concerning Minors

The services offered by Les Arcs are not specifically intended for minors.
When data relating to a minor is processed in connection with a reservation, a tourist activity, or an event, it is done so under the responsibility of the minor’s legal guardian.

15. Policy Updates

This policy may be amended to reflect legislative, regulatory, or technical changes.
We encourage you to review it regularly to stay informed of the most recent version.
Version: 1.0
Last updated: August 2026