Data controller
The data controller is the publisher of the site, identified in the legal notice. For any question about your data: [email protected].
Data collected
If you simply browse the site
No data is requested. Like any web server, ours may technically record your IP address and the pages requested in its logs, to ensure the security and proper functioning of the site.
If you make a booking
- first name and surname;
- email address and phone number;
- date, preferred time, route and group makeup (boats, any meals);
- the version of the booking terms you accepted;
- your IP address at the time of the request, for security purposes;
- the payment status of the 10% platform fee. Your card or payment details are entered with Stripe: we neither see nor store them.
If you ask for a river alert
Your email address, the rivers chosen, the language, the date and IP address of the request and of the confirmation (proof of your consent), and the date of the last email sent. Alerts are only sent after you confirm from your inbox.
If you create an account
First name, last name, email address, phone (optional), language, password (stored in an irreversibly encrypted form: we cannot read it), dates of creation, address verification and last login, IP address at creation. Your bookings are found through your verified email address.
Audience measurement
To know which pages are useful, the server records each page viewed: date, page, language, country (derived by Cloudflare from your IP address, which is not kept), the site you came from, device type and browser. A visit identifier is computed each day from your IP address and browser, then irreversibly hashed with a key renewed every day: it can neither identify you nor follow you from one day to the next. No cookie is used and this data is shared with no one.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Process your booking, pass it on to the hire company, send you confirmations | Performance of a contract (Art. 6(1)(b)) |
| Collect the platform fee, keep accounts, refund where applicable | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Limit abuse and automated submissions on the form, secure the site | Legitimate interest (Art. 6(1)(f)) |
| Keep proof of your booking in case of a dispute | Legitimate interest (Art. 6(1)(f)) |
| Sending you the river alerts you asked for | Consent (Art. 6(1)(a)), which you can withdraw at any time through the link in every email |
| Managing your customer account and showing you your bookings | Performance of a contract (Art. 6(1)(b)) |
| Measuring site audience, without cookies, to improve it | Legitimate interest (Art. 6(1)(f)) |
We do not use your contact details for marketing or for a newsletter. No automated decision producing legal effects concerning you is taken.
Recipients
- The hire company concerned (Récréalle, Kayaks Libert or Coo Adventure) receives your name, contact details and booking details, in order to prepare the trip and reach you. It then processes this data under its own responsibility.
- Stripe processes the payment of the platform fee.
- Mailjet delivers transactional emails and the river alerts (confirmation to you, message to the hire company).
- The site’s technical hosting provider, strictly for hosting purposes.
These providers may be established outside the European Union; in that case, the transfer relies on the safeguards provided for by the GDPR (for example standard contractual clauses). We neither sell nor rent your data.
Retention periods
- Customer account: until it is deleted, which you can do yourself at any time from your account.
- Audience measurement: 13 months, then automatic deletion.
- River alerts: until you unsubscribe, which erases your data immediately; a request that is never confirmed is erased after 7 days.
- Anti-abuse counter: an irreversible fingerprint (hash) of your IP address and the time of your submissions are kept for 1 hour, then erased.
- Bookings: 3 years after the date of the trip, for accounting, refunds and defence in case of a dispute. Some accounting records may have to be kept longer if the law requires it.
- Technical server logs: for a limited period, as needed for security.
After these periods, the data is deleted or anonymised.
Cookies, trackers and preferences
The site sets no advertising cookies and no trackers. It sets only one cookie, technical and strictly necessary, and only if you log in to your account: the “ka_session” session cookie, deleted when you log out or after 30 days. The audience measurement described above works without cookies. The booking form is protected by a security token embedded in the page, without a cookie. There is one exception: at the payment step, the card field is provided by Stripe, whose script may set its own cookies to prevent fraud; they are covered by Stripe’s privacy policy and are present only if you open this step.
If you embed the water level widget on your site, it is up to you to inform your own visitors of what your page loads.
Your rights
You may request access to your data, its rectification, its erasure, restriction of processing, object to processing based on legitimate interest and request the portability of your data. To do so, write to [email protected] enclosing your booking reference: we may ask you to prove your identity. Erasure may be limited for as long as the law requires us to keep a record.
For data held by the hire company, also contact them.
If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).
Security
Exchanges with the site are encrypted, the form is protected against fraudulent submissions and access to bookings is limited to those who need it. No measure, however, offers absolute security.
Changes
This policy may change; the online version is the one that applies. See also the booking terms.