Privacy Policy
Version 1 — 2 November 2026
1. Introduction
The purpose of this policy is to inform users of the website www.cimes-et-horizon.fr (hereinafter ‘the Website’) about how their personal data is collected, used and protected by Cimes et Horizon, in accordance with:
- Regulation (EU) 2016/679 on the protection of personal data (GDPR);
- the amended French Data Protection Act of 6 January 1978;
- the recommendations of the CNIL.
2. Data Controller
Personal data collected via the Website is processed by:
Cimes et Horizon SAS with a share capital of €10,000 1 place Marie Curie, 74000 Annecy, France RCS Annecy 108 246 273
Email: contact@cimes-et-horizon.fr
Cimes et Horizon acts as the data controller for data relating to the use of the Website, the management of quote requests, customer relations, bookings and the administrative follow-up of trips.
3. Local partner
In organising trips, Cimes et Horizon works with its exclusive local partner in Nepal.
To ensure the smooth delivery of tourism services, certain personal data necessary for organising the trip (participants’ identities, travel dates, relevant medical information where applicable) are passed on to the local partner as well as to local service providers involved in delivering the trip (accommodation providers, guides, transport operators).
Our partner acts as a data processor for operations carried out on behalf of Cimes et Horizon, under the partnership agreement concluded between the two companies.
4. Personal data collected
We may collect the following categories of data:
Identification data: surname, first name, email address, telephone number, postal address.
Travel-related data: participants, dates of birth, travel preferences, information required to book tourist services, travel documents, history of communications and bookings.
Browsing data: language preferences, display preferences, pages viewed, traffic statistics.
Special categories of data: information relating to health or specific needs, collected only where strictly necessary for the traveller’s safety, with your explicit consent.
5. Purposes of processing
Personal data is used in order to:
- respond to requests for quotes and enquiries;
- design and organise trips;
- manage bookings, contracts and invoicing;
- provide assistance to travellers before and during their stay;
- pass on the information necessary for the trip to be carried out to our partner;
- comply with our legal and accounting obligations;
- improve the Website and the user experience;
- send our newsletter, where you have given your consent.
6. Legal basis for processing
Processing is based on:
- the performance of the travel contract;
- the user’s consent (newsletter);
- compliance with legal obligations;
- the legitimate interest of Cimes et Horizon in improving its services and the security of the Website.
7. Recipients of the data
Personal data is only disclosed where necessary:
- to our local partner in Nepal;
- to local tourism service providers (accommodation providers, transport operators, guides);
- to administrative authorities where required by law.
Cimes et Horizon never sells your personal data to third parties.
8. Hosting and technical processors
- Website hosting: Scaleway SAS, infrastructure located in France.
- Audience measurement tool: Plausible Analytics, hosted and operated by Cimes et Horizon, in France.
- Newsletter distribution tool: Brevo, an email marketing solution hosted within the European Union.
- Mapping: OpenStreetMap, a service operated by the OpenStreetMap Foundation. When you view a page containing a map (for example an itinerary), your browser downloads the map tiles directly from OpenStreetMap’s servers. Your IP address, along with the technical information usually sent by browsers (browser type, referring page), is therefore disclosed to OpenStreetMap, which needs it to deliver the tiles. Cimes et Horizon has no access to this data. For more information, see the OpenStreetMap Foundation privacy policy.
9. Transfers outside the European Union
In connection with the organisation of trips to Nepal, certain data is transferred to our Nepalese partner, which is located outside the European Union.
This transfer is necessary for the performance of the travel contract concluded with the Customer (Article 49(1)(b) of the GDPR).
10. Data retention periods
| Type of data | Retention period |
|---|---|
| Prospects (unconverted quote requests) | 3 years from the last contact |
| Travelling customers (customer relationship data) | 5 years after the trip |
| Accounting and tax data | 10 years |
| Newsletter (marketing consent) | Until unsubscribed |
11. Data security
Cimes et Horizon implements technical and organisational measures designed to ensure the security and confidentiality of personal data, including: access control, secure hosting, encryption of data transfers, and regular backups.
12. Your rights
In accordance with the applicable regulations, you have the following rights: the right to access, rectify, erase, object to, restrict the processing of, and transfer your data, as well as the right to determine what happens to your data after your death.
You may exercise your rights by writing to contact@cimes-et-horizon.fr or by post to the registered office address set out in Article 2.
You also have the right to lodge a complaint with the CNIL: www.cnil.fr.
13. Cookies
13.1 What is a cookie?
A cookie is a small file stored on your device when you browse the Website. It is used to store information relating to your visit (preferences, technical identifiers, audience statistics).
13.2 Cookies used on the Website
Essential cookies
These cookies are essential for the Website to function and are exempt from consent in accordance with Article 82 of the French Data Protection Act:
- language preference;
- display preference;
- saving your draft contact form, to prevent the loss of your entries.
You can delete them from your browser settings.
Web analytics
The Website uses Plausible Analytics, hosted and operated by Cimes et Horizon, to compile visitor statistics and improve our content. This tool does not set any cookies, does not identify visitors and does not track them from one site to another. The data collected is anonymous, is not cross-referenced with any other processing, and is not shared with any third party.
13.3 Retention period
- Technical preference cookies (language, theme, form drafts): retained on your device until deleted via your browser.
- Audience measurement data: maximum 25 months.
14. Links to third-party websites
The Website may contain links to websites operated by third parties. Cimes et Horizon cannot be held liable for the privacy policies applied by these third-party websites.
15. Changes to the policy
This privacy policy may be updated at any time to reflect legal, technical or organisational changes. The applicable version is the one published on the Website.