1. Who We Are
TravelBond ("we," "us," or "our") is an independent digital travel publication and reader-funded membership collective, registered in France. Our registered address is: 12 Ruelle du Port, 75004 Paris, France.
We operate the website available at travelbond.com (the "Platform"), including all subpages, newsletters, and member services. When you use our Platform, subscribe to our newsletter, create a member account, or interact with any of our services, you are sharing personal information with us. This Privacy Policy describes how we handle that information in compliance with the General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés), and other applicable data protection laws.
For any questions about this policy or your data, you may contact us at: privacy@travelbond.com.
2. Data We Collect
We collect different categories of personal data depending on how you interact with us:
2.1 Information You Provide Directly
- Account registration: Name, email address, and password when you create a free member account.
- Newsletter subscription: Email address and optionally your name and travel interest preferences.
- Contact form submissions: Name, email address, and the content of your message.
- Comments & community contributions: Display name, email, and any content you submit publicly.
- Payment information: If you purchase a paid membership, payment details are collected and processed by our third-party payment processor (Stripe). We do not store full payment card numbers.
2.2 Information Collected Automatically
- Device & browser data: IP address, browser type, operating system, screen resolution, and device identifiers.
- Usage data: Pages visited, time on page, articles read, links clicked, scroll depth, and navigation paths.
- Referral data: The URL that referred you to our site and the search terms used to find us.
- Log files: Server logs automatically recording requests made to our infrastructure, including timestamps and error codes.
2.3 Information from Third Parties
- Social media: If you sign in using a third-party service (e.g., Google), we receive your profile name and email address with your consent.
- Analytics providers: Aggregated and anonymized behavioral data from services like Plausible Analytics or equivalent privacy-respecting tools.
3. How We Use Your Data
We use your personal data for the following purposes:
- Providing and maintaining our services: To operate your member account, deliver newsletters, and give you access to member-only content.
- Communications: To send you email newsletters, editorial digests, and service-related notifications (e.g., password resets, membership receipts).
- Personalisation: To recommend articles, films, and destinations that may be relevant to your stated travel interests.
- Platform improvement: To analyse usage patterns, detect errors, and improve the editorial experience across the Platform.
- Security & fraud prevention: To protect our Platform, users, and community from unauthorized access, abusive behaviour, or fraudulent activity.
- Legal obligations: To comply with applicable laws, respond to legal requests, and enforce our Terms of Use.
- Marketing communications: With your explicit consent, to send promotional content about membership tiers, events, or editorial collections. You may withdraw consent at any time.
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
4. Legal Basis for Processing
Under the GDPR, we process your personal data on the following legal grounds:
- Performance of a contract (Art. 6(1)(b) GDPR): When you create an account or subscribe, processing your data is necessary to deliver the service you requested.
- Legitimate interests (Art. 6(1)(f) GDPR): We process usage and analytics data to improve our services, ensure security, and detect abuse, where this is balanced against your rights and does not override them.
- Consent (Art. 6(1)(a) GDPR): For optional communications such as marketing emails, interest-based personalisation, and non-essential cookies, we rely on your explicit, freely given consent. You may withdraw it at any time.
- Legal obligation (Art. 6(1)(c) GDPR): Where we must retain or disclose data to comply with a legal requirement (e.g., tax records, law enforcement requests).
6. Data Sharing
We do not sell or share your personal data except in the following limited circumstances:
- Service providers: We work with trusted third-party providers who help us operate our Platform (e.g., email delivery, cloud hosting, payment processing). These providers are contractually bound to protect your data and may only use it to provide services to us.
- Legal requirements: We may disclose your data if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our legal rights or the safety of our users or the public.
- Business transfers: In the event of a merger, acquisition, or sale of our assets, your data may be transferred to the successor entity, subject to the same privacy protections described in this policy.
- With your consent: We may share your data with third parties when you have explicitly consented to such sharing.
Our current sub-processors include: Stripe (payment processing), Mailgun or similar (email delivery), and Hetzner or similar (cloud infrastructure). An up-to-date list is available upon request.
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law:
- Member account data: Retained for the duration of your membership and for up to 3 years after account closure to handle disputes or legal claims.
- Newsletter subscriber data: Retained while you remain subscribed. If you unsubscribe, we delete your data within 30 days, except where retention is required to prove compliance.
- Transaction records: Retained for 10 years to comply with French accounting and tax obligations.
- Server logs: Retained for a maximum of 12 months before deletion or anonymisation.
- Contact form messages: Retained for up to 2 years to manage ongoing correspondence, then deleted.
8. Your Rights
If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with comparable data protection laws, you have the following rights:
- Right of access (Art. 15 GDPR): You may request a copy of all personal data we hold about you.
- Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
- Right to erasure (Art. 17 GDPR): Also known as the "right to be forgotten," you may request deletion of your personal data where there is no compelling reason for its continued processing.
- Right to restriction (Art. 18 GDPR): You may request that we restrict processing of your data while a dispute is being resolved.
- Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format and transfer it to another controller.
- Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests, including profiling and direct marketing.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint: You have the right to complain to your national supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL): cnil.fr.
To exercise any of these rights, please email us at privacy@travelbond.com. We will respond within 30 days.
9. International Data Transfers
TravelBond is operated from the European Union. However, some of our service providers may be located in, or transfer data to, countries outside the EEA. In such cases, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Adequacy decisions where the destination country has been deemed to provide an adequate level of protection.
- Binding Corporate Rules for intra-group transfers within multi-national service providers.
You may request a copy of the safeguards in place by contacting us at privacy@travelbond.com.
10. Children's Privacy
Our Platform is intended for users who are at least 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at privacy@travelbond.com and we will take steps to delete such information promptly.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unlawful destruction, alteration, unauthorised disclosure, or access. These measures include:
- Encryption of data in transit using TLS/SSL protocols.
- Encrypted storage of passwords using industry-standard hashing algorithms (bcrypt).
- Access controls limiting data access to authorised personnel on a need-to-know basis.
- Regular security assessments and vulnerability monitoring.
- Incident response procedures to notify affected users and authorities in the event of a data breach, in compliance with Art. 33–34 GDPR.
While we take these precautions seriously, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password for your account and to notify us immediately if you suspect unauthorised access.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this page.
- Send a notification to all registered members by email at least 14 days before the changes take effect.
- Display a prominent notice on our Platform for 30 days following any material update.
Your continued use of the Platform after the effective date of any changes constitutes your acknowledgement of the revised policy. If you disagree with any changes, you may delete your account by contacting us.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us through any of the following channels:
- Email: privacy@travelbond.com
- Postal address: TravelBond — Data Privacy, 12 Ruelle du Port, 75004 Paris, France
- Contact form: travelbond.com/contact
We aim to respond to all requests within 30 calendar days. For complex requests, we may extend this by a further two months and will inform you accordingly.