Privacy Policy

Last updated: 10 November 2026

This policy explains what personal data Spots Travel collects when you use www.spotstravel.co, why we use it, who receives it, and the rights you have over it.

Who we are

Spots Travel, 27 rue Quincampoix, 75004 Paris, France, is the controller of your personal data. For any question about this policy or your data, email vip@spotstravel.co.

What we collect and why

Trip and contact requests

Contact form (on the contact and itinerary pages): your name, email address, number of travelers, preferred travel style, your message and, on itinerary pages, the trip you are asking about. The form is sent to our team by email. We use it to reply to you and to plan your trip. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
Trip planner (the “Plan your trip” window): your destination, dates, number of travelers and pets, and, for hotel requests, your nightly budget. The website does not send this anywhere. It opens a pre-filled email in your own email app, and we only receive it if you send it.
WhatsApp: if you contact us through our WhatsApp link, your messages are handled by WhatsApp (Meta) under its own privacy policy, and by us to answer you.

If you sign up, we collect your email address and store it with Mailchimp, our newsletter provider. You confirm your subscription from an email we send, and every newsletter has an unsubscribe link. Legal basis: your consent (Article 6(1)(a) GDPR).

Analytics

We use Google Analytics 4, loaded directly and through Google Tag Manager, to understand how the site is used and to improve it. It records the pages you visit (including the web address), how you arrived, your approximate location derived from your IP address, your device and browser type, and clicks on our booking and trip-planning buttons. We do not send your name, email address or form contents to Google Analytics. Legal basis: your consent (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act).

How this works depends on where you are, based on your IP address:

European Union, United Kingdom, California and everywhere outside the United States: Google Analytics and Google Tag Manager only load if you click “Accept” in the cookie banner. If you decline, or make no choice, nothing from Google Analytics is loaded and no analytics cookies are set.
Elsewhere in the United States: Google Analytics is on when you arrive, and you can turn it off with “Opt out” in the banner or “Your Privacy Choices” at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and ask first.

When Google Analytics runs, it sets these cookies:

_ga: distinguishes visitors (up to 2 years)
_ga_<ID>: keeps the state of your visit (up to 2 years)

Embedded maps and videos

Itinerary pages show Google Maps, and some guides include YouTube videos. When they load, Google and YouTube receive your IP address and may set their own cookies, under their own privacy policies.

Technical data

Our hosting provider, Vercel, keeps server logs (IP address, browser, pages requested) to run and secure the site. Page content and images are delivered by Sanity, our content management system, whose servers also receive your IP address. Legal basis: our legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR).

We do not sell personal data, we do not use advertising trackers, and we do not make automated decisions about you.

Who receives your data

Our team, and these service providers acting on our behalf:

Google: email (Google Workspace), Analytics, Tag Manager, Maps and YouTube
Mailchimp (Intuit): newsletter
Vercel: website hosting
Sanity: content management and image delivery
View Source, our web developer: a backup email service, used only if a contact form email fails to send
WhatsApp (Meta): only if you contact us there

Transfers outside the European Union

Some of these providers are based in, or process data in, the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

How long we keep it

Enquiries: as long as needed to answer you and plan your trip; if no trip follows, up to 3 years after our last contact.
Booking and invoicing records: for as long as French law requires (up to 10 years for accounting documents).
Newsletter: until you unsubscribe.
Analytics data: up to 14 months.
Server logs: a short period, under our hosting provider’s standard retention.

Your rights

Under the GDPR and French data protection law, you can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can withdraw your consent at any time, without affecting what was done before. You can also give instructions on what happens to your data after your death. To exercise any of these rights, email vip@spotstravel.co. We reply within one month.

You can also complain to the French data protection authority, the CNIL (www.cnil.fr), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Cookies and how to control them

The website sets one cookie of its own, spots-consent-model, which records which of the rules above applies to your region; it lasts until you close your browser and is not used for tracking. Your cookie choice is stored in your browser’s local storage for 6 months, after which we ask again. You can change your choice at any time with “Your Privacy Choices” at the bottom of every page; if you withdraw consent or opt out, we delete the Google Analytics cookies. Embedded maps and videos may set their own cookies. You can also block or delete cookies in your browser settings.

Children

This website is not intended for children under 15, and we do not knowingly collect their personal data.

Changes to this policy

We will update this page when our practices change. The date at the top shows when it was last updated.