Privacy policy
Effective date: 28 August 2026 • Data controller: Trabeler SAS, 24 Rue de Rivoli, 75004 Paris, France • DPO: [email protected]
This Privacy Policy explains what personal data trabeler (“we”, “us”) collects, why we collect it, how we use it, and your rights under the EU General Data Protection Regulation (GDPR), UK GDPR, and applicable US state laws (e.g., CCPA as amended). It applies to trabeler.com, checkout, and related services.
1. Data we collect
- Booking data: full name, phone (with country code), email/confirm email, date/time, ticket type/variant, guests breakdown, time slot if applicable.
- Payment data: payment method choice and transaction metadata. Card details are processed by PCI-DSS compliant providers (Stripe/Adyen/PayPal); we do not store full card numbers.
- Contact & support: messages to [email protected] or legal/dpo addresses, including attachments.
- Technical data: IP address, device/browser, language, currency preference (stored locally), referrer, pages viewed, and approximate location derived from IP.
- Cookies & similar: see section 5.
2. How and why we use your data - legal bases
| Purpose | Legal basis |
|---|---|
| Provide bookings, tickets, confirmation emails and Partner handover | Contract (Art. 6(1)(b) GDPR) |
| Process payments and prevent fraud | Contract + Legitimate interest (Art. 6(1)(b),(f)) |
| Customer support and service messages | Contract / Legitimate interest |
| Comply with tax, accounting and legal obligations | Legal obligation (Art. 6(1)(c)) |
| Analytics, product improvement, currency preference | Legitimate interest / Consent where required |
| Marketing (if you opt in) | Consent (Art. 6(1)(a)) |
3. Sharing
We share data only as needed:
- Partners operating the experience (e.g., venue) - to validate tickets and manage entry.
- Service providers: payment processors, email delivery (e.g., SendGrid), hosting/CDN, analytics (privacy-conscious configuration), customer support tooling.
- Legal: if required by law, court order, or to protect rights and safety.
- We do not sell personal data. For CCPA purposes we do not “share” or “sell” as defined.
4. International transfers
Data is primarily processed in the EU/EEA. Where transfer outside the EEA is needed (e.g., US-based providers), we rely on adequacy decisions or Standard Contractual Clauses (SCCs) and supplementary measures, as required by Chapter V GDPR.
5. Cookies
We use:
- Essential: booking state (BookingProvider localStorage), currency choice, checkout hold timer, CSRF.
- Analytics (consent-based where required): aggregated usage to improve conversion and error rates.
You can control cookies via your browser. Blocking essential cookies may break checkout.
6. Retention
- Booking and invoice data: 10 years for tax/accounting (French Commercial Code).
- Support correspondence: 3 years after last contact.
- Analytics logs: 14–26 months.
- Hold/temporary data (e.g., localStorage “trabeler_booking”): until completed or cleared by you.
7. Your rights
Under GDPR you have the right to access, rectify, erase, restrict, object, portability, and to lodge a complaint with your supervisory authority (e.g., CNIL in France). To exercise rights, email [email protected] with proof of identity. California residents have the right to know, delete, correct, and non-discrimination; contact us at the same address with “CCPA Request”.
8. Security
We use TLS encryption in transit, encrypted secrets at rest, role-based access, and PCI-DSS compliant payment flows. No system is 100% secure; please use a strong device password and keep your confirmation QR private.
9. Children
Our services are not directed to children under 16. We collect guest ages only to price tickets (e.g., Adult/Child) as provided by you for the booking.
10. Automated decision-making
We do not make solely automated decisions with legal or similarly significant effects. Fraud checks may flag a transaction for manual review.
11. Changes
We will post updates here with a new effective date and, for material changes, notify you by email or in-product notice. Continued use after the effective date constitutes acceptance.
12. Contact
Data controller: Trabeler SAS, 24 Rue de Rivoli, 75004 Paris, France.
DPO: [email protected] - General: [email protected]
For booking help see Help Center, for contractual terms see Terms of Use and for refunds see Cancellation Policy.