Personal data protection

1. Data collected and purposes

Mandatory and optional data. Only the data in the “Account” row is required: without it, the account cannot be created and the service cannot be provided. All other data you provide yourself is optional. Not providing it has no consequence on your access to the service, with one obvious exception: without publishing a hike or signing up for one, you cannot use the corresponding features.

Legitimate interests pursued. Technical logs are kept in order to identify outages and errors, detect fraudulent attempts to access an account, and document a security incident. We have verified that this processing, limited to technical data and to a short period, does not disproportionately affect your rights.

No automated decision-making. No decision producing legal effects concerning you, or significantly affecting you, is taken by automated means. The service carries out no profiling and computes no score.

No data is sold or transferred for advertising purposes.

2. Who sees your data

This is the most important question for a service that connects people. A published hike indicates that a person will be at a specific place, at a specific time. Bear this in mind before publishing.

Visible to everyone, including visitors who are not logged in, and to search engines Published hikes: title, dates, times, start, finish and meeting points, difficulty, distance, description, images and attached documents, together with the username and profile picture of the organiser. These pages are public and may be indexed.

Visible to logged-in members The same information, plus comments, replies and “likes”, with the username and profile picture of their authors.

Visible only to confirmed participants of the same hike The phone number of members who have consented to share it. This sharing is revocable at any time from your personal area.

Visible to you alone Your email address, your password, your country of residence, your account data and your participation history, accessible from your personal area.

Disclosed to third parties Apart from the technical providers listed in section 3, no data is disclosed to third parties, except on judicial request or where required by law.

3. Processors and recipients

4. Data location and transfers

Application data is stored in the European Union: the database at Neon, the back-end services at Railway, uploaded files in Cloudflare R2 object storage and transactional emails at Brevo.

Three processing operations involve a transfer to the United States:

• hosting of the public website by Netlify;
• locating and displaying places by Google (Maps / Places);
• audience measurement by Google (Analytics).

Those transfers rely on the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which Netlify and Google are certified, supplemented where applicable by the standard contractual clauses of the Commission.

Storage in a European region does not rule out all access from a third country: the support teams of our providers may, for maintenance purposes, occasionally access data from another country. Such access is governed by the safeguards provided for in Chapter V of the GDPR.

You may obtain a copy of the safeguards applicable to these transfers by writing to admin@hike-planet.com.

5. Retention periods

Accounts inactive for three years are notified and then deleted.

Hikes and comments kept under the “Deactivated account” identity are no longer linked to an identifiable person: they fall outside the scope of data protection law and are therefore not subject to a maximum retention period.

6. Overview of processing activities

This table summarises the processing carried out by the service. It does not replace the internal record required by article 30 of the GDPR, which is kept by the publisher.

7. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time for the processing that relies on it.

To exercise these rights, write to admin@hike-planet.com from the email address associated with your account. Requests are handled within one month.

You may lodge a complaint with the supervisory authority of your country of residence, or with the CNIL, the lead supervisory authority for Hike-Planet. In the United Kingdom, the competent authority is the ICO; in Switzerland, the FDPIC.

8. Account deletion

You may at any time request the deletion of your account on a self-service basis, from the web application, without installing the mobile application and without being logged in. The procedure is set out on the Account deletion page.

Before the request is taken into account, the authenticity of the account email address is verified. This verification is necessary: it prevents a third party from having your account deleted by impersonating you.

As soon as the request is confirmed, the account is deactivated and you can no longer log in. Upcoming hikes for which you are the organiser are cancelled and their participants are informed; they lose their participants and their comments, then revert to draft. Your sign-ups for upcoming hikes are cancelled.

You then have a 30-day grace period to reactivate your account from the same page. Reactivation restores the account to its previous state, except for the hikes and sign-ups cancelled at the time of the request. It is not available to a suspended account: deletion cannot be used to lift a suspension.

At the end of that period, deletion results in the erasure of the account, the profile, the profile picture, the phone number, the participation history, the authentication data and hike drafts. An email confirms the deletion.

Past hikes, their images and published comments are not deleted: they are permanently dissociated from their author and attached to a generic “Deactivated account” identity. The username is removed from the content in which it appears and image metadata is erased. This operation is irreversible and retains no means of restoring the link with the person. Content anonymised in this way is kept so as not to disrupt the history and the exchanges of the other participants.

9. Data export

Self-service export is not available in the current version of the Service. To obtain a copy of your data, send your request to admin@hike-planet.com.

A confirmation request is sent to the email address registered on the account, and the archive is only produced once your reply has been received. It is then made available at that same address. The request is handled manually, within the one-month period stated in section 7.

The archive provided contains the profile, published hikes, participation, comments and uploaded images, in a structured, commonly used and machine-readable format. It is made available through a time-limited download link sent to the account email address.

10. Cookies and audience measurement

The website uses Google Analytics to measure its traffic. No advertising network is present and no advertising cookie is set.

Audience measurement relies on your consent. You may at any time request that your measurement data no longer be collected by writing to admin@hike-planet.com, and configure your browser to refuse measurement cookies.

List of cookies and trackers

11. Controller and contact

The controller is HERONT IT, a société par actions simplifiée (French simplified joint-stock company) registered with the Nanterre Trade and Companies Register under number 912 033 974, whose registered office is at 14 rue de Bagneux, 92330 Sceaux, France.

For any question relating to your data, or to exercise your rights, write to admin@hike-planet.com.

No data protection officer has been appointed, such an appointment not being mandatory given the publisher’s activity and size.