Privacy Policy

1. Introduction

The purpose of this policy is to inform users of the website www.detoursmadagascar.com (hereinafter "the Site") about how their personal data is collected, used and protected by Nomadays, in accordance with:

Regulation (EU) 2016/679 on the protection of personal data (GDPR),
the amended French Data Protection Act (loi Informatique et Libertés),
as well as the recommendations of the CNIL (the French data protection authority).

2. Data Controller

Personal data collected via the Site is processed by:

NOMADAYS SAS
10 Allée Jean Bringer, 34260 Le Bousquet d'Orb, France
RCS Béziers 837904267

Email: service.clientele@nomadays.com

Nomadays acts as the data controller for data relating to the use of the Site, the management of quote requests, customer relations, the booking and administrative follow-up of trips, as well as access to the customer area.

3. Local Partner Agency

As part of the organisation of the trips offered on the Site, Nomadays works with independent local partner agencies, in particular:

DETOURS MADAGASCAR, based in Madagascar.

In order to ensure the proper performance of the tourism services, certain personal data necessary for the organisation of the trip may be transmitted to this local agency as well as to the service providers involved in carrying out the trip.

Depending on the nature of the processing carried out, the local partner agency may act:

either as a processor acting on behalf of Nomadays,
or as a separate data controller for operations directly relating to the local execution of the trip.

4. Personal Data Collected

We may collect the following categories of data:

Identification data

Surname, first name, email address, telephone number, postal address.

Travel-related data

Participants, dates of birth, travel preferences, information necessary for booking tourism services.

Customer account data

Browsing data

IP address, device type, pages viewed, browsing statistics.

Payment data

Processed exclusively by our secure payment provider Stripe — Nomadays does not have access to card numbers.

Special data

Certain information relating to health or specific needs may be collected only where strictly necessary for the organisation of the trip, with your consent.

5. Purposes of the Processing

Personal data is used in order to:

respond to quote requests;
design and organise trips;
manage bookings, contracts and invoicing;
provide access to the customer area;
provide traveller assistance before and during the trip;
personalise our travel suggestions;
comply with legal and accounting obligations;
improve our services and the user experience;
send commercial communications where you have consented to them.

6. Legal Basis for the Processing

The processing is based on:

the performance of the travel contract;
the user's consent;
compliance with legal obligations;
the legitimate interest of Nomadays in improving its services and the security of the Site.

7. Recipients of the Data

Personal data is only transmitted where necessary:

to local partner agencies;
to tourism service providers (accommodation, carriers, guides, activities);
to technical service providers ensuring the operation of the Site;
to administrative authorities where required by regulations.

Nomadays never sells personal data to third parties.

8. Hosting and Technical Subprocessors

To provide its services, Nomadays uses technical subprocessors, selected for their security guarantees and governed in accordance with Article 28 of the GDPR:

Data hosting: Supabase (infrastructure located in the European Union);
Application hosting: Vercel and Railway;
Secure payment: Stripe;
Artificial intelligence assistance: Anthropic (see Article 9);
Sending of transactional emails: dedicated emailing provider.

9. Use of Artificial Intelligence

Nomadays uses artificial intelligence tools (Anthropic Claude) to assist its advisors in processing requests (brief summaries, suggestions of tailored itineraries). The data transmitted to these tools is anonymised beforehand: name, email and telephone are systematically removed.

No automated decision producing legal effects is made by the artificial intelligence: a human advisor validates each proposal before any dispatch.

10. Transfers Outside the European Union

As part of the organisation of international trips, certain data may be transferred to partners located outside the European Union.

Nomadays ensures that such transfers are governed by appropriate safeguards in accordance with the requirements of the GDPR, in particular where the data is necessary for the performance of the travel contract.

11. Data Retention Period

Data is retained only for the period necessary for the purposes pursued:

Type of data	Retention period
Prospects (unconverted quote request)	3 years from the last contact
Travelling customers (relationship data)	5 years after the trip
Accounting and tax data	10 years
Newsletter / marketing consent	Until unsubscription
Cookies and browsing data	13 months maximum

12. Data Security

Nomadays implements technical and organisational measures intended to ensure the security and confidentiality of personal data, in particular:

access control,
secure hosting,
encryption of communications,
regular backups.

13. Your Rights

In accordance with the applicable regulations, you have the following rights:

right of access;
right to rectification;
right to erasure;
right to object;
right to restriction of processing;
right to data portability;
right to determine the fate of your data after your death.

You may exercise your rights by writing to service.clientele@nomadays.com or by post:

Nomadays
10 Allée Jean Bringer, 34260 Le Bousquet d'Orb, France

You also have the right to lodge a complaint with the CNIL: www.cnil.fr

14. Cookies and Audience Measurement

The Site uses essential cookies (operation, session, storage of your cookie choices) and, subject to your consent, analytics and marketing cookies. The details are described in our cookie policy.

Our internal audience measurement (Nomadays nd.js) collects anonymous statistics for our sole use, without transmission to any third party: truncated /24 IP address, ephemeral 30-minute session identifier, retention for a maximum of 13 months, no cross-site tracking. This measurement is exempt from consent by the CNIL. You may change your choices at any time via the cookie manager.

15. Links to Third-Party Sites

The Site may contain links to external sites. Nomadays cannot be held liable for the privacy policies applied by these third-party sites.

16. Amendment of the Policy

This privacy policy may be updated at any time in order to reflect legal, technical or organisational developments.

The version in force is the one published on the Site.

This document is a translation of the French original, provided for convenience. In the event of any discrepancy, the French version shall prevail.