Privacy policy

Opidun (hereinafter "we", "us" or "the Platform") is an online accommodation booking platform (OTA - Online Travel Agency) accessible at https://opidun.com. We place fundamental importance on protecting your personal data and complying with the General Data Protection Regulation (GDPR - EU Regulation 2016/679).

1. Object

This privacy policy describes how we collect, use, store and protect your personal data when you use our platform.

3. Personal data collected

We collect the following categories of data:

### 2.1 Data provided directly by you

- **Identifying data**: last name, first name, email address, phone number

- **Account data**: login credentials, password (encrypted), language preferences

- **Reservation data**: dates of stay, number of travelers, accommodation preferences, special requests

- **Payment details** : credit card information (processed by our secure payment provider Stripe - we do not store your card numbers)

- **Communication data**: messages exchanged with hosts, requests to customer support

- **Reviews and ratings**: notes, comments and photos you publish

### 2.2 Data collected automatically

- **Browsing data**: IP address, browser type, operating system, pages visited, visit duration

- **Geolocation data**: approximate location based on IP address (to offer you relevant accommodations)

- **Cookies and similar technologies**: see our Cookies Policy for more details

### 2.3 Data from third parties

- **Social authentication**: if you log in via Google, Facebook or Apple, we receive your first name, last name and email address associated with your account

- **Hosting partners** : information about your stays (confirmations, modifications, cancellations)

** : notes, comments and photos you publish

4. Purposes and legal basis of processing

Purposes and legal basis of the processing

| Purpose | Legal basis | Retention period |

|----------|-------------|----------------------|

| Creation and management of your account | Contract performance | Account duration + 3 years |

| Processing your reservations | Contract fulfillment | 5 years after reservation |

| Processing payments | Contract fulfillment / Legal obligation | 10 years (accounting obligation) |

| Communication regarding your reservations | Contract fulfillment | 3 years after last contact |

| Sending newsletters and promotional offers | Consent | Until withdrawal of consent |

| Improving our services and personalization | Legitimate interest | 3 years |

| Statistical analysis and audience measurement | Legitimate interest | 13 months (cookies) |

| Fraud prevention and security | Legitimate interest / Legal obligation | 5 years |

| Customer review management | Legitimate interest | 5 years after publication |

| Responding to your support requests | Contract performance | 3 years after last contact |

---

## 4. Data recipients

Your personal data may be shared with:

### 4.1 Operating partners

- **Partner hosts**: last name, first name, dates of stay, number of travelers and special requests (required to fulfill your reservation)

- **Payment provider** : Stripe (PCI DSS certified) for secure payment processing

### 4.2 Technical subcontractors

- **Amazon Web Services (AWS)** : infrastructure hosting, data storage, analytics and machine learning services (servers located in the EU - eu-west-3 region, Paris)

- **Mailgun** : sending transactional and marketing emails

- **Mapbox** : mapping and geolocation services

- **Google Analytics** : audience measurement (anonymized data)

### 4.3 Social authentication

If you choose to log in via a third-party service:

- **Google** (Google Ireland Limited): email, last name, first name, profile picture

- **Facebook** (Meta Platforms Ireland Limited): email, last name, first name, profile picture

- **Apple** (Apple Distribution International Ltd): email, last name, first name

These services do not receive any data from us. They only send us the information needed to create your account, with your explicit consent.

### 4.).

---

## 5. Data transfers outside the EU

Our data is mainly hosted in the European Union (AWS eu-west-3, Paris). However, some of our subcontractors may process data outside the EU:

- **Stripe** : United States - Standard Contractual Clauses (SCC) from the European Commission

- **Mailgun** : United States - Standard Contractual Clauses (SCC)

- **Google** : United States - EU-US Data Privacy Framework

- **Apple** : United States - Standard Contractual Clauses (SCC)

In all cases, we ensure that appropriate safeguards are in place in accordance with Articles 46 and 49 of the RGPD.

---

## 6. Data security

We implement appropriate technical and organizational measures to protect your data :

- **Encryption** : all communications are encrypted via HTTPS/TLS

- **Passwords** : stored as irreversible cryptographic hashes

- **JWT Tokens** : secure authentication via HttpOnly cookies

- **Restricted access** : only authorized employees have access to personal data

- **Guards** : regular, encrypted backups on AWS infrastructure

- **Monitoring**: continuous access monitoring and intrusion detection

---

## 7. Your rights

In accordance with the GDPR, you have the following rights:

### 7.1 Right of access (article 15)

You can obtain confirmation that your data is being processed and receive a copy.

### 7.2 Right of rectification (article 16)

You may request the correction of inaccurate or incomplete data.

### 7.3 Right to erasure (Article 17)

You may request the deletion of your personal data, subject to our legal retention obligations.

### 7.4 Right to the limitation of processing (Article 18)

You may request the limitation of processing in certain circumstances.

### 7.5 Right to portability (article 20)

You can receive your data in a structured, commonly used and machine-readable format.

### 7.6 Right to object (article 21)

You may object to the processing of your data for legitimate reasons, including commercial prospecting.

### 7.7 Right to withdraw consent

When processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of the previous processing.

### How to exercise your rights

You can exercise your rights:

- **By email**: [email protected]

- **From your account** : privacy settings in your personal space

- **By mail**: to the Opidun headquarters address

We will respond to your request within a maximum of 30 days.

### CNIL complaint

If you feel that the processing of your data constitutes a violation of your rights, you can lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):

- Website: https://www.cnil.fr

- Address : 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

---

## 8. Cookies

We use cookies and similar technologies for the operation of the platform, audience measurement and personalization of your experience. For more information, see our [Cookie Policy](https://opidun.com/fr/footer/legal/cookies).

You can manage your cookie preferences at any time via the "Cookie Settings" link at the bottom of every page.

---

## 9. Protection of minors

Our platform is not intended for persons under the age of 18. We do not knowingly collect data from minors. If we discover that a minor has provided us with personal data, we will delete it as soon as possible.

---

## 10. Policy Changes

We reserve the right to change this privacy policy at any time. In the event of substantial modification, we will inform you by email or by notification on the platform.

The date of last update is indicated at the top of this page.

---

## 11. Contact

For any questions regarding this privacy policy or the processing of your personal data:

- **Email**: [email protected]

- **Support**: https://opidun.com/en/contact

- **Website** : https://opidun.com

Privacy policy

Privacy policy

1. Object

2. Data controller

3. Personal data collected

1. Object

2. Data controller

3. Personal data collected

4. Purposes and legal basis of processing