PRIVACY POLICY
Personal Data Protection — www.cantal-nature.com
Last updated: June 10, 2026
This policy describes the processing of personal data carried out in connection with the website and the Cantal Nature marketplace. It is separate from the Legal Notice and the General Terms and Conditions of Sale and Use (GTCU).
1. Data Controller
GIE Cantal Nature — Le Bourg, 15190 Saint-Saturnin, France — SIREN 102 879 889 — contact@cantal-nature.com — +33 7 49 66 06 61.
Where a member Professional processes data on its own behalf and determines the purposes and means of the processing, that Professional may be the data controller for such processing. Information specific to such processing will then be provided by the Professional.
2. Categories of Data That May Be Processed
• identification and contact details;
• data relating to requests, bookings, orders and services;
• data necessary for invoicing and monitoring the contractual relationship;
• communications with customer service;
• account data, where an account is offered;
• technical and connection data necessary for the operation and security of the website;
• preferences and consents;
• reviews or published content, where this functionality is available.
For the general use of the marketplace, the GIE does not request sensitive personal data. If a service exceptionally requires specific categories of data, the conditions applicable to such processing will be specified before the data is collected.
3. Source of the Data
Data is primarily collected directly from the data subject, in particular when making contact, booking, placing an order, potentially creating an account or using a form. Certain data may be received from the relevant Professional or may originate from technical mechanisms, including cookies, in accordance with the conditions described in the Cookie Policy.
4. Purposes and Legal Bases
• handling requests: pre-contractual measures or legitimate interest, depending on the circumstances;
• bookings, orders, payments and service management: performance of the contract and legal obligations;
• invoicing and accounting: legal obligations;
• complaints and fraud prevention: legitimate interest and/or legal obligations;
• commercial communications: consent where required;
• reviews: depending on the procedures actually implemented;
• audience measurement: consent where required, with certain trackers potentially being exempt under specific conditions;
• security, maintenance and protection of rights: legitimate interest and/or legal obligations.
5. Mandatory Nature of the Information
Information necessary for an order, booking, request or compliance with a legal obligation is indicated as mandatory whenever possible. Failure to provide such information may prevent the request from being processed or the contract from being performed.
6. Recipients
Data may be accessible to the GIE, persons responsible for the website and customer relations, the relevant Professional and technical service providers necessary for the operation of the website, including hosting, maintenance, payment, messaging and security providers. Such recipients only have access to the data necessary for the performance of their functions.
The GIE does not sell its users’ personal data.
7. Payments
Where online payment is offered, the data necessary for the transaction may be processed by the payment service provider actually used. The name of the provider and the final terms must be specified as soon as the provider is selected. The GIE does not retain bank card data beyond what is necessary and legally permitted by the system used.
8. Data Retention
Data is retained for a period proportionate to the purpose pursued and, where required by law, for the applicable statutory retention periods.
• contact requests: for the period necessary to process the request and, where justified, for the period useful for maintaining the relationship;
• accounts: for the duration of the account and thereafter for the period necessary to comply with legal obligations or protect legal rights;
• orders, invoices and accounting records: applicable statutory retention periods;
• marketing communications: until consent is withdrawn or for the applicable regulatory period;
• cookies: in accordance with the Cookie Policy.
The precise retention periods must be aligned with the record of processing activities and the actual technical settings of the website.
9. Transfers Outside the EEA
If a service provider involves a transfer of data outside the European Economic Area, such transfer shall be governed in accordance with the GDPR, in particular through an adequacy decision or appropriate safeguards provided for by applicable regulations.
10. Security
The GIE implements appropriate technical and organisational measures to protect data against loss, alteration, disclosure or unauthorised access.
11. Rights
Under the conditions provided for by the GDPR and the French Data Protection Act (Loi Informatique et Libertés), individuals have, in particular, the rights of access, rectification, erasure, restriction of processing, objection and, where the applicable conditions are met, data portability. Where processing is based on consent, consent may be withdrawn at any time.
Exercise of rights: contact@cantal-nature.com. Proof of identity may be requested where necessary to prevent identity theft or impersonation.
12. Complaint to the CNIL
Any person may lodge a complaint with the CNIL: www.cnil.fr.
13. Cookies
Cookies and other trackers are described in the Cookie Policy. Trackers subject to consent are only placed or read after valid consent has been obtained, except where an exemption is provided for by applicable regulations.
14. Amendments
This policy may be amended to take account of legal, technical or functional developments. The published version indicates its date of update.