Last updated: April 16, 2026
This Policy describes how the SASU BLACK TENDERS EVENTS, hereinafter «Black Tenders», collects, uses, and protects the personal data of users of blacktenders.fr, in accordance with Regulation (EU) 2016/679 (GDPR) and the amended Data Protection Act.
1. Data controller
SASU BLACK TENDERS EVENTS
9025 B Boulevard du Bon Puits, 06210 Mandelieu-la-Napoule
RCS Cannes 823 982 442
Email: [email protected] — Tel.: 06 30 83 88 72
Represented by: Emilie Gilardo, President
2. Data collected
- Identification: last name, first name, email, phone ;
- Reservation: date, schedule, number of passengers, boarding point, preferences, medical information possibly communicated for on-board safety; ;
- Payment: processed exclusively by Stripe (or equivalent provider) acting as a joint data controller for this purpose. Black Tenders does not retain any banking data. ;
- Navigation: IP address, browser type, pages visited, visit duration, via cookies (see Cookie Policy) ;
- Communications: email content, messages, contact forms.
3. Purposes, legal bases, and durations
| Purpose | Legal basis | Conservation |
|---|---|---|
| Reservation Management and Contract Execution | Contract execution (Art. 6.1.b) | 3 years after the last performance |
| Billing and accounting | Legal obligation (Art. 6.1.c) | 10 years (Commercial Code) |
| Claims and Litigation Management | Legitimate interest (Art. 6.1.f) | 5 years |
| Business emails and newsletters | Consent (Art. 6.1.a) | Until withdrawal or 3 years of inactivity |
| Audience Measurement (Google Analytics 4) | Consent (Art. 6.1.a) | 13 months (CNIL recommendation) |
| Site security, fraud prevention | Legitimate interest | 1 year |
4. Recipients and subcontractors
The data is processed by authorized Black Tenders personnel and, depending on the purpose, transmitted to the following subcontractors:
- Hosting and CDN Cloudflare, Inc. (United States) for website delivery; the original host (France/EU) for storage.
- Payment: Stripe Payments Europe Ltd (Ireland) for transaction processing.
- Commercial distribution: GetYourGuide Germany GmbH (Germany) and other partner platforms when booking is made there.
- Transactional and marketing emails: [TO COMPLETE: Brevo / Mailjet / other].
- Analytics: Google Ireland Ltd (Google Analytics 4) subject to consent.
- Mapping Mapbox / Google Maps for displaying pick-up points.
- Administrative or judicial authorities, when the law requires it.
Black Tenders does not sell or rent users' personal data.
5. Transfers outside the EU
Certain subcontractors (notably Stripe, Cloudflare, Google) may transfer data outside the European Union. These transfers are governed by the European Commission's standard contractual clauses (decision 2021/914) and, where applicable, by the EU-U.S. Data Privacy Framework for certified subcontractors.
6. Safety
TLS encryption across the entire site, application firewall via Cloudflare, limited admin access, strong authentication, regular backups, WordPress and plugin security updates.
7. User Rights
In accordance with the GDPR, you have the following rights:
- Right of access, rectification, erasure, restriction, portability, objection; ;
- Right to withdraw your consent at any time; ;
- The right to set guidelines on the fate of your data after your death.
To exercise these rights: [email protected]. A copy of an identification document may be requested in case of reasonable doubt about the applicant's identity. Response within one month.
In case of disagreement, a complaint can be filed with the CNIL: www.cnil.fr.
8. Cookies
use of cookies is detailed in the Cookie Policy.
9. Modification
Black Tenders may modify this Policy at any time. The current version is the one published on the website. Any substantial modification will be brought to the attention of affected users.
