Privacy Policy

Important: This Privacy Policy is governed by French law and the European Union’s General Data Protection Regulation (GDPR). References to legal provisions refer to the French legal framework and EU regulations.

This Privacy Policy aims to present, in a transparent and general manner, the way in which GUESTRAVELER processes the DATA of USERS (including MEMBERS) and protects their privacy when they connect to the WEBSITE or download the APP, access the PLATFORM and wish to benefit from the SERVICE or make REPORTS.

Capitalized terms used in this Privacy Policy have the same meaning as those defined in the Terms of Use.

In particular, the notion of DATA is that referred to in Article 4 of the GDPR. The same applies to the notion of processing.

This Privacy Policy aims to inform USERS (i) of the manner in which GUESTRAVELER collects, uses and discloses their DATA, and (ii) of the rights they have over their DATA.

It applies when USERS visit the PLATFORM and also when they register to access the NOHÔ matchmaking services on the APP or WEBSITE and when, as MEMBERS, they use the SERVICE.

Identification of the data controller: GUESTRAVELER, a simplified single-shareholder joint-stock company (SASU) with share capital of 13,000 euros, registered under number 821 903 374 with the Caen Trade and Companies Register, whose registered office is located at 73 rue Marie Curie, 14200 Hérouville-Saint-Clair, France. Contact for any question regarding data protection: contact@noho.world.

DATA collected and processed by GUESTRAVELER and/or transmitted to third parties
Processing activities carried out
Methods of collecting DATA
Purposes of collection and their legal bases
Duration of DATA retention
Recipients of DATA
Transfer of DATA
Technical and organizational measures
Retention and security of DATA
Procedure in case of data breach
Rights of USERS (and MEMBERS)
Duties of MEMBERS
Information and complaint procedures
Modifications to the Privacy Policy
Cookies section

1. DATA Collected and Processed by GUESTRAVELER and/or Transmitted to Third Parties

The DATA collected is primarily:

Information obtained when the USER accesses the WEBSITE or APP, such as their IP address, connection information.
Information entered by the USER when registering on the PLATFORM or subsequently: last name, first name, email and postal address, phone number, photograph, video, date of birth, profession, password, communication content information (phone, SMS, emails, etc.).
Information retrieved from third-party sources via social networks, when the USER has authorized this.
Technical information related to the USER’s browsing on the WEBSITE or APP.
Information on complaints and REPORTS.

2. Processing Activities Carried Out

GUESTRAVELER carries out the following DATA processing activities related to the PLATFORM and SERVICE:

USER management
ACCOUNT management
NOMAD management
HOST management
PASSION SHARING EXPERIENCE management
Review of pricing approval requests and related appeals
Monitoring of the annual activity volume of HOSTS
Messaging management between MEMBERS
Cookie management on the PLATFORM
REPORT management
PLATFORM security management

3. Methods of Collecting DATA

GUESTRAVELER collects data in two ways:

Through direct input of data communicated by USERS and MEMBERS when they visit the WEBSITE or APP, make contact via the contact form, create an account, offer or register for a PASSION SHARING EXPERIENCE, use the internal messaging, browse the PLATFORM or use the SERVICE, or leave REVIEWS. Depending on the nature of the collection, it is based on performance of the contract, GUESTRAVELER’s legitimate interest, or on the free, specific, informed and unambiguous consent of the data subject.

Through the USERS’ use of the PLATFORM and MEMBERS’ use of the SERVICE (IP address, connection references, browsing, operating system, language, GPS functionality or any other information automatically disclosed by the device used).

GUESTRAVELER is also likely to use cookies. The USER can refuse their deposit via the cookie management banner or disable their support in their browser, which may alter browsing performance.

More specifically

When the USER accesses the PLATFORM

GUESTRAVELER does not collect or retain any personal data when the USER accesses the PLATFORM if they refuse non-essential cookies and do not contact GUESTRAVELER via the contact form.

If they fill in a contact form, the following data is collected: first name, last name, email address, subject of message, content of message. This DATA is used to process the message and respond to the USER, and is retained for one year.

When the USER wishes to become a MEMBER

DATA collected: email address, first name, last name, date of birth, password (created by the USER).

The USER may choose not to provide the requested DATA, but this may limit their access to the SERVICE, in particular for booking PASSION SHARING EXPERIENCES.

When the MEMBER uses the SERVICE

The MEMBER communicates additional DATA, such as:

Useful additional DATA (phone numbers, profession, qualifications, photographs, languages spoken, etc.).
Data related to the PASSION SHARING EXPERIENCE (contact details, schedule, photographs, etc.).
Data related to payment and allocation of BOOKING FEES and HOST PAYOUTS (in particular bank details for HOSTS).
Where the HOST sets a BOOKING FEE exceeding €35, the elements submitted in support of the approval request: duration, equipment and materials, costs incurred, specific features of the activity.
The cumulative amount of BOOKING FEES received by the HOST during the calendar year.
Data related to REVIEWS.

4. Purposes of Collection and Their Legal Bases

Any data collection is carried out for a specific and legitimate purpose. In accordance with Article 6 of the GDPR, each purpose is based on an identified legal basis.

Purpose	Legal Basis (Article 6 GDPR)
Facilitate USER browsing on the WEBSITE or APP	Legitimate interest
Enable USERS to optimally use and browse the PLATFORM	Performance of contract / Legitimate interest
Subscribe USERS to a newsletter about services offered	Consent
Enable USERS to open an ACCOUNT to become a MEMBER	Performance of contract
Enable NOMADS to access payment service and HOSTS to receive HOST PAYOUTS via STRIPE	Performance of contract
Enable MEMBERS to benefit from the SERVICE offered by NOHÔ	Performance of contract
Enable MEMBERS to communicate with each other via messaging	Performance of contract
Review approval requests for LISTINGS priced above €35 and handle any appeals	Performance of contract
Monitor each HOST’s annual activity volume to preserve the non-professional character of the SERVICE	Legitimate interest
Operate, protect and improve the SERVICE	Legitimate interest
Analyze and distribute REVIEWS retrospectively	Legitimate interest / Performance of contract
Comply with legal obligations, resolve disputes and enforce commitments	Legal obligation
Respond to USER and MEMBER requests	Performance of contract / Legitimate interest
Use of analytical and marketing cookies	Consent
Transmission of information to the tax administration (DAC7)	Legal obligation

DATA collected is, in principle, used within the framework of the stated purpose.

No exclusively automated decision-making. GUESTRAVELER does not take any decision producing legal effects concerning a MEMBER solely on the basis of automated processing. Decisions relating to the approval of a LISTING, the suspension of LISTINGS of a HOST who has reached the annual activity limit, or the suspension of an ACCOUNT, are taken by a team member, are reasoned, notified, and may be appealed under the conditions provided in the Terms of Use.

5. Duration of DATA Retention

DATA is retained for the duration necessary to exercise the stated purpose.

Data of an active MEMBER ACCOUNT: for the entire duration of the ACCOUNT, plus one (1) year from closure, unless a longer legal duration applies.
ACCOUNT inactive for three (3) years: automatic deletion after reminder without response from the MEMBER.
Connection log data: one (1) year.
Accounting and invoicing data: ten (10) years (Article L123-22 of the French Commercial Code).
Commercial prospecting data (newsletters): until withdrawal of consent.
Cookies: maximum duration of thirteen (13) months, choice renewed every six (6) months.
Elements submitted in support of a pricing approval request and corresponding decisions: three (3) years from the decision.
Cumulative annual activity amount of the HOST: retained for the current calendar year, then for the duration required by applicable tax regulations.

In case of inactivity on an ACCOUNT for three (3) years (absent prior closure), the DATA relating to the MEMBER is deleted.

6. Recipients of DATA

GUESTRAVELER is the primary recipient of DATA.

Certain DATA may be transmitted to external processors (payment services, IT services). The list of main processors appears in Article 9 below.

Certain DATA is also transmitted to public authorities, notably the French tax administration, to which GUESTRAVELER is required to communicate each year the HOST’s identifying information, the number and gross amount of transactions, and the bank details used for payment (Article 7 of the Terms of Use). DATA may also be communicated to administrative or judicial authorities upon proper requisition.

When a MEMBER offers or registers for a PASSION SHARING EXPERIENCE, they have knowledge of the last name, first name, email address and phone number of the MEMBER concerned, and must respect the rights of other MEMBERS in accordance with Article 12 below.

7. Transfer of DATA Outside the European Union

Some processors (STRIPE for payments, Google for audience measurement, Meta for marketing tracking, Brevo for email management) may transfer data outside the European Union, in particular to the United States.

These transfers are governed by mechanisms under Chapter V of the GDPR:

adequacy decisions adopted by the European Commission (Article 45 GDPR), in particular the decision of July 10, 2023, concerning the EU-US Data Privacy Framework, for certified US processors;
standard contractual clauses (Article 46 GDPR), supplemented where appropriate by additional technical and organizational measures.

GUESTRAVELER undertakes to ensure that DATA is protected in accordance with EU legislation, regardless of the location of processing.

8. Technical and Organizational Measures

GUESTRAVELER undertakes to implement appropriate technical and organizational measures, proportionate to the nature, scope, context and purposes of processing, to ensure GDPR compliance.

9. Retention and Security of DATA

As data controller, GUESTRAVELER is responsible for the retention and security of DATA.

Main processors:

IMAGILE MH Communication, 171 rue Epron, 14200 Hérouville-Saint-Clair, France — technical support for the PLATFORM.
ALWAYSDATA, 62 rue Tiquetonne, 75002 Paris, France — hosting of the PLATFORM.
STRIPE Payments Europe Ltd. (Ireland) — payment processing.
Google Ireland Limited — audience measurement via Google Analytics.
Meta Platforms Ireland Limited — marketing tracking via Meta Pixel.
Brevo (formerly Sendinblue), 106 boulevard Haussmann, 75008 Paris, France — marketing email management.
Tarteaucitron — cookie preference management.

This list is provided for information purposes and is subject to change. Updated list available on request at contact@noho.world.

10. Procedure in Case of Data Breach

In accordance with Article 33 of the GDPR, any DATA breach likely to result in a risk to the rights and freedoms of natural persons will be notified to the CNIL within a maximum of 72 hours from becoming aware of the breach.

In accordance with Article 34 of the GDPR, when the risk is high, GUESTRAVELER will communicate the breach to the USER concerned as soon as possible, except in cases provided for by the GDPR.

11. Rights of USERS (and MEMBERS)

USERS have the following rights:

Right of confirmation as to whether or not DATA concerning them is being processed.
Right of access to the DATA and a copy of it, along with information relating to the processing.
Right of rectification, completion or erasure of DATA.
Right to limitation of processing in certain cases.
Right to portability of DATA provided, in a structured, machine-readable format.
Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
Right to object, on grounds relating to their particular situation, to processing based on legitimate interest — objection to prospecting is a matter of right.
Right to specify the fate of DATA upon death.

In case of manifestly unfounded or excessive requests (repetitive nature, Article 12 GDPR), the data controller may refuse to act on the request or require payment of administrative costs.

Response period: one (1) month from receipt of the request, extendable by two (2) months depending on complexity, with the USER informed. If the request is incomplete, the deadline is suspended until receipt of additional information.

In case of reasonable doubt as to the identity of the applicant, a copy of an identity document may be requested, to the strict extent necessary.

Any request must be sent in writing to contact@noho.world, or by postal mail to: GUESTRAVELER, 73 rue Marie Curie, 14200 Hérouville-Saint-Clair, France.

12. Duties of MEMBERS

MEMBERS who have knowledge of DATA of other MEMBERS in the context of a PASSION SHARING EXPERIENCE undertake to:

Use this DATA only to enable the PASSION SHARING EXPERIENCE concerned, during its organization and execution.
Keep it confidential and delete it at the end of the PASSION SHARING EXPERIENCE.
Respect the privacy and image rights of other MEMBERS.
Not record, publish or distribute content reproducing the image or voice of MEMBERS without their prior written authorization, and justify this to GUESTRAVELER before any posting on the PLATFORM.

13. Information and Complaint Procedures

All requests must be sent to contact@noho.world or by postal mail to GUESTRAVELER, 73 rue Marie Curie, 14200 Hérouville-Saint-Clair, France, specifying last name, first name, email address and the subject of the request.

Response period: thirty (30) days from receipt of the complete request.

USERS also have the right to lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

14. Modifications to the Privacy Policy

GUESTRAVELER complies with GDPR No. 2016/679 of April 27, 2016, and French Law No. 78-17 of January 6, 1978, as modified by Law No. 2024-449 of May 21, 2024, and Decree No. 2019-536 of May 29, 2019.

GUESTRAVELER reserves the right to modify this Privacy Policy, in particular to comply with legal developments.

The date of the version in force appears at the top of this document. In the event of a significant modification, MEMBERS will be informed by email.

15. Cookies

This section supplements the Terms of Use and the Privacy Policy.

GUESTRAVELER uses cookies and other tracers that may automatically install on the USER’s terminal (computer, mobile, tablet) via their browser software, as well as mobile service identifiers and similar technologies.

What is a Cookie?

A cookie is a small text file placed on the hard drive or in the browser’s memory of the USER, allowing storage of technical data readable when consulting a website (number of visits, IP address, pages visited, etc.).

Cookies Used by GUESTRAVELER

These technologies primarily improve WEBSITE and APP functionality, recognize the USER, facilitate browsing, and help detect certain types of fraud.

Analytical and marketing cookies are only deposited after the USER’s prior consent has been collected, in accordance with Article 82 of the French Data Protection Act.

Strictly Necessary Cookies

Installed to ensure proper functioning of the WEBSITE, APP, PLATFORM and SERVICE. They cannot be disabled. Data is deleted as soon as the USER leaves the page; no personal data is stored.

Functionality Cookies

Allow proper browsing and personalize functionality. Without acceptance, some or all functionality may not work.

Analytical Cookies

Use of Google Analytics 4 for audience measurement. Deposited only after consent, retained for a maximum of 13 months.

Marketing Cookies

Cookies from Meta (Facebook Pixel) and Brevo, for conversion tracking and email campaign management. Deposited only after consent.

Cookies Summary Table

Cookie name	Type	Duration	Company
_noho_backend_session	Strictly necessary	14 days	Nohô
__stripe_mid	Functionality (payment)	2 years	Stripe
__stripe_sid	Functionality (payment)	1 year	Stripe
_fbp	Marketing (consent required)	3 months	Meta (Facebook)
_ga	Analytical (consent required)	13 months	Google Analytics
_ga_C4HBM4E6BT	Analytical (consent required)	13 months	Google Analytics
sib_cuid	Marketing (consent required)	6 months	Brevo (formerly Sendinblue)
tarteaucitron	Technical (consent management)	1 year	Tarteaucitron

Advertising Cookies

GUESTRAVELER does not use advertising cookies.

Accept All, Reject All, Customize

When accessing the WEBSITE or APP, a window informs the USER of their rights and data processing. Blocking certain cookies may impact the browsing experience.

Accept All: accepting the deposit of cookies constitutes consent to their use.

Reject All: option to click “Reject All” (other than necessary cookies). This choice is taken into account for six (6) months, then proposed again upon a new connection.

Browser configuration options:

Microsoft Edge: Settings > Cookies and site permissions > Cookies and site data.
Firefox: Menu > Settings > Privacy & Security.
Chrome: Menu > Settings > Privacy and security > Cookies and other site data.
Safari: Preferences > Privacy > Cookies and website data.

Customize: “Customize” button on the cookie banner; choice taken into account for six (6) months.

Withdraw Consent: at any time via “Manage my cookie preferences” at the bottom of the page.

Rights of USERS Regarding DATA Communicated by Cookies

Same rights as those referred to in Article 11: access, rectification, revocation of consent, portability, objection, fate of data upon death.

Exercise of rights via contact@noho.world, specifying last name, first name, email address and subject of the request. Response within thirty (30) days maximum.

Third-Party Cookies

Some cookies are issued by third parties: Google (audience measurement), Meta (marketing), Stripe (payment), Brevo (email). These cookies involve data transfer to these third parties (see Article 7).

Third-party social network plug-ins (Facebook, X, LinkedIn, YouTube) are installed on the WEBSITE and APP; the third party may have access to information consulted if the USER is logged into their account on these networks.