Privacy policy

1. Introduction

This Privacy Policy (the “Policy”) explains how the publisher of HANDI ACCESS collects, processes and protects your personal data when you use the Site and the HANDI ACCESS mobile application.

This Policy is issued in accordance with the General Data Protection Regulation (GDPR) 2016/679 of 27 April 2016 and the French Loi Informatique et Libertés n° 78-17 of 6 January 1978, as amended.

By using the Site or the application, you acknowledge that you have read and accepted this Policy. If you do not accept it, please do not use them.

2. Controller

Data controller:

3. Data collected

When you use the Site, we may collect and process the following personal data:

3.1. Data collected through forms

When you use forms on the Site (contact, listing, report), we collect the information you provide, including identity, contact details, the message and the date of the request.

3.2. Data collected automatically

When you browse or authenticate, certain technical data are processed: session cookies, authentication tokens, and security logs required to operate the service. In the current version of the Site, these processing operations do not include audience measurement or marketing automation.

3.3. Analytics and marketing tools

No audience-analytics or marketing-automation tool is deployed at this time. No cookie of that kind is set. If those processing operations were put into service, this Policy and the cookie register would be updated, and prior consent would be obtained where required.

3.4. Mobile application

The HANDI ACCESS mobile application does not require an account. The following processing may occur:

• Device location: collected only when you tap “Around me” or “Recenter”, and only to show the nearest accessible venues on screen. This location is never sent to HANDI ACCESS servers and is not stored on the device beyond the current display.
• Accessibility preferences: stored locally on the device. They are not transmitted.
• Report: if you report incorrect information, the reason, the message and, where provided, the contact email you enter are sent to the publisher so the listing can be corrected. No account is created.
• Map tiles: the map loads IGN Géoplateforme tiles for the visible area, as on the Site. Those requests do not contain the device GPS location.

4. Purposes of processing

Your personal data are collected and processed for the following purposes:

4.1. Handling contact and listing requests

• Purpose: Responding to contact, information or listing requests
• Legal basis: Consent or pre-contractual steps (GDPR article 6.1.a or 6.1.b)
• Retention: For the time needed to handle the request, then as required by applicable law

4.2. Site improvement and audience analytics

No audience-analytics processing is currently implemented. This purpose is therefore not pursued until a tool is deployed.

4.3. Marketing and communication

No newsletter or marketing automation is currently operated from the Site. This purpose will be pursued only if you later consent to it, where applicable.

4.4. Security, authentication and fraud prevention

• Purpose: Securing the Site, authenticating accounts, preventing abuse
• Legal basis: Legitimate interest and, where applicable, performance of a contract (GDPR articles 6.1.f and 6.1.b)
• Retention: For the session, and security logs for as long as needed for those purposes

4.5. Mobile application

• Purpose: showing nearby accessible venues, remembering accessibility filters on the device, and handling voluntary reports
• Legal basis: consent for location (system permission, GDPR article 6.1.a); legitimate interest for processing reports (GDPR article 6.1.f)
• Retention: location is not stored; reports are kept for as long as needed to correct the listing, then as required by applicable law

5. Legal basis

Under the GDPR, processing of your personal data rests on the following legal bases:

• Consent (article 6.1.a): for non-essential cookies, when they are used, for any marketing communication, and for device location in the mobile application
• Performance of a contract or pre-contractual steps (article 6.1.b): for accounts, listing and responding to your requests
• Legitimate interest (article 6.1.f): for Site security and fraud prevention
• Legal obligation (article 6.1.c): where retention of records is required by law

6. Recipients

Your personal data are intended for the publisher and its authorised staff, the hosting provider, competent authorities where legally required, and the following processors, each strictly within its mandate:

We do not sell your personal data to third parties.

7. Transfers outside the European Union

Your personal data are mainly hosted and processed in the European Union and in Switzerland.

Hosting in Switzerland:

Data may be hosted in Switzerland by the technical hosting subcontractor. Switzerland benefits from an adequacy decision of the European Commission recognising that its data-protection law provides an adequate level of protection under the GDPR. Transfers to Switzerland are therefore carried out in accordance with the GDPR without additional safeguards.

Other transfers:

Where data are transferred to a third country, in particular for payments, we rely on an adequacy decision, the EU–US Data Privacy Framework where it applies, or the European Commission’s standard contractual clauses. The so-called “Privacy Shield”, invalidated in 2020, is not used.

8. Retention periods

The periods below are target durations. In the current software version, no automatic purge is yet executed. Data are kept for as long as needed for the purposes described, for performance of the contract and for legal obligations, and are deleted or anonymised upon a valid rights request, subject to retention required by law.

• Contact and listing data: for the time needed to handle the request, then as required by law
• Account and dossier data: for the duration of the contractual relationship
• Cookies: as set out in the Cookie policy
• Security logs: for as long as needed for the security of the service

9. Your rights

Under the GDPR and the Loi Informatique et Libertés, you have the following rights in respect of your personal data:

9.1. Right of access (GDPR article 15)

You have the right to obtain confirmation as to whether data concerning you are processed and, where that is the case, to access those data.

9.2. Right to rectification (GDPR article 16)

You have the right to obtain rectification of inaccurate data concerning you and to have incomplete data completed.

9.3. Right to erasure (GDPR article 17)

You have the right to obtain erasure of your personal data in the cases provided for by the GDPR, in particular where the data are no longer necessary, where you withdraw consent and no other legal basis applies, or where the processing is unlawful.

9.4. Right to restriction of processing (GDPR article 18)

You have the right to obtain restriction of processing in certain cases.

9.5. Right to data portability (GDPR article 20)

You have the right to receive your personal data in a structured, commonly used format and to transmit them to another controller.

9.6. Right to object (GDPR article 21)

You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interest.

9.7. Right to withdraw consent

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

9.8. Right to give post-mortem instructions

You have the right to give instructions concerning the fate of your personal data after your death.

10. How to exercise your rights

To exercise your rights, you may contact us:

We will respond within one month of receiving your request.

For security reasons and to prevent identity theft, we may ask you to prove your identity.

11. Complaints to supervisory authorities

If you consider that the processing of your personal data infringes the GDPR or the Loi Informatique et Libertés, you have the right to lodge a complaint with the competent supervisory authority:

12. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, fraudulent use and unauthorised disclosure. These measures include authentication, access control, encryption in transit and backups.

No method of transmission over the Internet is completely secure. We cannot guarantee absolute security, but we undertake to take all reasonable steps to protect your data.

13. Cookies and similar technologies

The Site uses cookies and similar technologies. For more information, see our Cookie policy.

14. Changes to this Policy

We may amend this Privacy Policy at any time, in particular to reflect changes in legislation, regulation or our practices.

Any change will be brought to your attention by updating the version and the last-updated date. Please consult this page regularly.

15. Contact

For any question about this Privacy Policy or the processing of your personal data, you may contact us:

Last updated: September 1, 2026