DLPTime

Privacy policy

Last updated: July 17, 2026

Preamble

This policy describes how personal data is collected and processed on dlptime.com, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.

Data controller

The data controller is Benjamin Polge, publisher of the website on a personal, non-professional basis.

Contact : benjaminpolge.com/fr/contact.php

Data collected

  • Browsing data : IP address (anonymised by Google Analytics), browser type, operating system, pages viewed, visit dates and durations, referrer.
  • Local preferences : stored in the browser — favourite attractions, chosen language and private itinerary access limited to the tab (sessionStorage). The private token is never sent to Google Analytics.
  • Personalised day plan : visit date and times, group composition and pace, attraction preferences, stated constraints or bookings, delivery email address and payment reference when the itinerary is purchased.
  • User feedback : bug or suggestion content intended for publication on GitHub, limited technical metadata, and an optional email address relayed privately without being stored in the database.
  • GPS location : used only on your device to calculate a walking route when you allow it. DLPTime does not receive, store or transmit your coordinates.
  • Audience measurement : cookies set by Google Analytics 4 to measure site traffic unless you have opted out (see the cookie policy for details).

No account is required. An email address is collected only to deliver or recover an itinerary, or when a user asks to be contacted about feedback.

Purposes

  • Provide the service: display wait times and forecasts, and remember language and favourites.
  • Create, deliver, update and secure the purchased personalised itinerary.
  • Receive, publish and handle voluntarily submitted bugs or suggestions.
  • Measure traffic and understand how the site is used in order to improve it.
  • Ensure site security (technical server logs) and prevent abuse.

Legal basis

Local preferences and core site functionality rely on the publisher's legitimate interest in providing a usable service (Article 6.1.f GDPR).

Audience measurement through Google Analytics relies on your prior consent. You can refuse or withdraw it at any time from the cookie policy without losing any feature.

Processing required to create, pay for and deliver the personalised itinerary is carried out to perform the requested service.

Publishing feedback and privately relaying an email address respond to the user’s voluntary request. The address is used only for that feedback.

Recipients

  • The site publisher, who alone accesses aggregated statistics and optional contact details relayed privately.
  • Google Ireland Limited and Google LLC, as processors for Google Analytics.
  • OVH SAS, as host (technical security logs only).
  • Stripe, as secure payment provider.
  • Resend, as provider of transactional itinerary emails.
  • GitHub receives the public feedback content, Cloudflare verifies the anti-bot check and Resend relays the optional email address to the publisher.

Transfers outside the European Union

Some providers listed above may process data in the United States. Where applicable, such transfers are governed by the European Commission’s adequacy decision of 10 July 2023 regarding the EU-US Data Privacy Framework, or by appropriate contractual safeguards. View the adequacy decision.

Retention period

  • Audience measurement cookies: 13 months maximum, in line with the CNIL recommendation. Aggregated data in Google Analytics: 14 months.
  • Local favourites are retained until deleted by the user. Itinerary access in sessionStorage is deleted when the tab is closed.
  • Private itinerary access expires 30 days after the visit. Associated data is retained to provide the service and manage the order.
  • Technical deduplication identifiers are kept for 30 days. The optional email address is relayed without being stored in the DLPTime database.
  • Technical server logs: 12 months maximum.

Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

  • Right to access your personal data.
  • Right to have inaccurate data corrected.
  • Right to erasure ("right to be forgotten").
  • Right to restrict processing.
  • Right to data portability.
  • Right to object to processing, in particular to audience measurement.
  • Right to withdraw your consent at any time, where processing is based on consent.
  • Right to issue directives regarding the retention, deletion and communication of your data after your death.

To exercise these rights, contact the publisher via the contact form.

Complaint to the CNIL

If, after contacting us, you believe that your data protection rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL): www.cnil.fr/fr/plaintes.

Cookies

For the list of cookies used and how to refuse them, see our Cookie policy.