Privacy Policy

Effective Date: January 1, 2026 • Last Revised: 2026 Edition • Compliant with GDPR (EU Regulation 2016/679) and CCPA

1. Introduction and Data Controller

Popvaulteditin Media Ltd. ("Popvaulteditin", "we", "our", or "us"), registered at Rue Saint-Honoré 142, 75001 Paris, France (Company No. EU-948201-B), operates the web publication and travel almanac popvaulteditin.surf. We are dedicated to respecting your privacy and safeguarding your personal information in strict compliance with the General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP), and the California Consumer Privacy Act (CCPA).

This policy details the operational methods through which we collect, process, maintain, and protect your personal information when you browse our travel calendars, subscribe to seasonal dossiers, or submit itinerary inquiries.

2. Categories of Personal Data Collected

We only collect data necessary to provide accurate, tailored travel calendar insights. The categories of information processed include:

Voluntary Identity and Contact Data: Name, email address, country of residence, and travel preferences submitted via our concierge inquiry forms.
Technical and Telemetry Data: IP addresses (anonymized), browser types and versions, operating system details, time zone settings, device identifiers, and referring URL paths.
Usage and Interaction Patterns: Pages visited, duration of session, specific months clicked within our 12-month calendar component, search filter preferences, and outbound link interaction.
Consent Records: Logs of your cookie selection preferences stored locally on your device via `localStorage`.

3. Legal Bases for Data Processing (GDPR Article 6)

Under European Union data protection legislation, we process your personal data under the following legitimate legal bases:

Consent (Art. 6(1)(a) GDPR): When you voluntarily submit an inquiry form or consent to non-essential analytics cookies.
Contractual Necessity (Art. 6(1)(b) GDPR): To respond to your direct itinerary planning requests and deliver agreed travel editorial guides.
Legitimate Interests (Art. 6(1)(f) GDPR): To maintain system security, detect fraudulent traffic, optimize website rendering speed, and understand broad aggregate seasonal search interest.

4. Data Retention and Security Protocols

We maintain industry-standard physical, technical, and managerial safeguards including end-to-end TLS 1.3 encryption for data in transit. Inquiries submitted via our contact forms are retained only for as long as required to resolve your consultation (maximum 18 months), after which data is permanently sanitized or deleted.

5. Third-Party Sub-Processors and Data Transfers

We do not sell, rent, or lease personal user data to any third-party marketing entities. Necessary operational sub-processors include:

Cloud Hosting Providers: Enterprise cloud infrastructure located exclusively within European Economic Area (EEA) data centers.
Privacy-Compliant Analytics: Aggregated measurement tools configured without cross-site tracking or user fingerprinting.

6. Your Statutory Rights under GDPR and CCPA

As a data subject, you maintain unconditional rights regarding your personal information:

Right to Access & Portability: Obtain a complete copy of any personal data we hold concerning you.
Right to Rectification: Request prompt correction of inaccurate or incomplete records.
Right to Erasure ("Right to be Forgotten"): Request total deletion of your personal records from our databases.
Right to Restrict or Object to Processing: Limit the scope of data operations or object to legitimate interest processing.
Right to Withdraw Consent: Revoke cookie or communication consent at any time with immediate effect.

7. Data Protection Officer (DPO) Contact

To exercise any of your statutory rights or to submit a data protection inquiry, please contact our Data Protection Officer at: [email protected] or by postal delivery to Popvaulteditin Media Ltd., Attn: Privacy Office, Rue Saint-Honoré 142, 75001 Paris, France.