Privacy policy
Last updated: 3 October 2026
Data controller
SEPTR – Syndicat des Entreprises de Petits Trains Touristiques Routiers, a non-profit association (SIREN 432 751 527) whose registered office is at 16-18 rue des Suisses, 06400 Cannes, France, represented by its President, Romain Leblond, is the controller of the personal data processed on petits-trains.com.
For any question about your data, write to us at contact@petits-trains.com, through the website's contact form (www.petits-trains.com/en/contact) or by post to 14 bis rue Daru, 75008 Paris, France.
Data processed, purposes and retention periods
Contact form and membership requests
- Data: name, email address, phone number (optional), subject and content of the message.
- Purposes: answering your request and sending you an acknowledgement email.
- Legal basis: our legitimate interest in answering the requests we receive; for a membership request, steps taken at your request before joining.
- Retention: 3 years from our last exchange.
Member directory
- Data: business information of member companies (name, address, phone, email, website, social media, photo, description and map position), published on the website.
- Purpose: making SEPTR member companies known to the public, local authorities and event organisers.
- Legal basis: performance of the membership and the legitimate interest of SEPTR and its members in promoting their business. Each member can edit their listing from their account at any time or ask for it to be removed.
- Retention: for the duration of the membership; the listing is removed from the website when it ends.
Member area and administration
- Data: login email address, password (stored encrypted) and technical session information.
- Purpose: allowing members to update their listing and the SEPTR team to manage the directory.
- Legal basis: performance of the membership.
- Retention: until the membership ends or the account is deleted.
Change history
- Data: for each creation, update or deletion of a member listing, who made the change (user ID and email), when, and the content of the listing before and after the change.
- Purposes: security, traceability and correcting mistakes.
- Legal basis: our legitimate interest in keeping the directory secure and accurate.
- Retention: 3 years, then automatically deleted. Only SEPTR administrators can access it.
Audience measurement
- The website uses Vercel Web Analytics, which sets no cookies and does not identify visitors or track them across websites. Only aggregated statistics are produced (pages viewed, country, device and browser type).
- Legal basis: our legitimate interest in measuring the website's audience.
Website security
- Your IP address is processed by our hosting provider, in particular to protect the website against abuse (for example by limiting how often the contact form can be sent).
- Legal basis: our legitimate interest in keeping the website secure. These technical logs are kept for a limited period by the hosting provider.
Member map
- When you display the map, your browser loads the map tiles from CARTO's servers (maps based on OpenStreetMap), which receive your IP address.
- Members' business addresses are converted into map coordinates with OpenStreetMap's Nominatim service when they are entered in the administration area.
Recipients and processors
Your data is intended for the SEPTR team. It is never sold or passed on. We use the following providers, who process it on our behalf:
- Vercel Inc. (USA): website hosting and audience measurement.
- Supabase: database, accounts and files, on servers located in Paris.
- Resend (USA): sending the emails related to the contact form.
- Amazon Web Services: encrypted backups, on servers located in Paris.
- CARTO and the OpenStreetMap Foundation: map tiles and geocoding of members' addresses.
- Shareloc (Versailles, France): website development and maintenance.
Transfers outside the European Union
Some providers are based in the United States. These transfers are covered by the safeguards provided by the GDPR: the European Commission's adequacy decision for companies certified under the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.
Backups
A backup copy of the database and files is made every day and kept for 90 days, in a storage space located in Paris.
Cookies
The website only uses technical cookies that are strictly necessary for signing in to the member area. They are only set if you sign in and do not require your consent. No advertising or audience measurement cookies are used.
Your rights
Under the GDPR and the French Data Protection Act, you have the following rights over your data:
- right of access and rectification;
- right to erasure;
- right to restriction of processing;
- right to object to processing based on our legitimate interest;
- right to data portability;
- right to set instructions for what happens to your data after your death.
To exercise these rights, write to us at contact@petits-trains.com, through the website's contact form or by post to 14 bis rue Daru, 75008 Paris, France. We will reply within one month.
If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Security
Exchanges with the website are encrypted (HTTPS). Access to data is limited to the people who need it: each member can only edit their own listing, and only SEPTR administrators can access the whole directory and the change history.
Changes to this policy
This policy may be updated, for example when the website or the regulations change. The date of the last update is shown at the top of this page.