Updated on 28 June 2021
Amaury Sport Organisation (hereinafter without distinction "A.S.O." or "We"), Data Controller of the Data of Users who browse the site www.letour.fr and the page www.letour.fr/en/club (hereinafter the "Site") knows how important is for Your the way Your Personal Data is processed and acknowledges the importance of protecting and respecting Your privacy. Therefore, We have put in place all appropriate security measures to guarantee the protection and security of Your Data.
We explain to You in this "Privacy Policy" (hereinafter "Policy") why and how We collect and process Your Data on the Site, with whom and how We are likely to share it and, above all, Your rights relative to the protection of Personal Data and how You can exercise them.
We will refer to the Document, when We refer jointly to the General Conditions of Use of the Site, the Cookies Policy, and the Privacy Policy of the Site, which constitute a whole.
A.S.O. may modify and update the Policy at any time, in particular to take into account the evolutions of the Site, the services proposed and the applicable regulations.
Any changes we make will apply immediately upon notification, by any means, including, but not limited to, by posting a revised version of this Policy. You can find out when it was revised by referring to the "Last Updated" notice at the top of this Policy.
The French version of this Policy is authentic and prevails over any translation.
If you have any questions about the Privacy Policy,please contact our DPO at the address dpoaso@aso.fr
I. Definitions
In this Document, words or expressions beginning with a capital letter refer to the terms defined in the General Conditions of Use and, failing that, will have the definition of Article 4 of Regulation (EU) 2016/679 (known as "GDPR"):
"Consent" means any free, specific, informed and unambiguous expression of will by which the data subject agrees, by a statement or by a clear positive act, that Personal Data concerning him or her may be processed;
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing. In this case, A.S.O. may be considered as Data Controller or Joint Data Controller when You log in through Facebook or Google to Your Club account;
"Cookie": text file containing information about the User of the Site, saved by the browser used by the User and which contains certain information about the User on the hard drive of the device used by him. The cookie has a limited lifespan and We will ask For Your consent whenever necessary.
"Data Processing" means any operation or set of operations carried out or not by automated means and applied to Data or sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, limitation, erasure or destruction;
"Independent Controller" means the legal person, public authority, service, or any other body that independently defines the means of Processing the Personal Data of the Controller, for its specific purposes, limited to a specific context.
"Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); is deemed to be an "identifiable natural person" a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location Data, an online identifier, or to one or more elements specific to his physical, physiological, genetic, mental, economic, cultural or social identity;
"Pixel": refers to a 1x1 pixel graphic that is loaded when the User opens a web page or an email. The Pixel makes it possible to trace all the activity of a User on the Web, regardless of the pages visited after the one where a Pixel is located. We only use the Facebook and Google Pixel that allow You to log in to the Club page using Your personal accounts on Facebook or Google.
"Processor" means the natural or legal person who processes Personal Data on behalf of the Data Controller;
"Recipient" means the natural or legal person, public authority, agency, or any other body that receives communication of Personal Data, whether it is a third party. In this case, A.S.O. may send Your data to its Partners or share it with social networks that allow You to log in using Your account at the Club;
"Social Networks" means sharing spaces on the Internet that allow the User of the Site to follow the Tour or the other events proposed by the Site in social networks.
"Tag": Refers to an element introduced in each of the pages whose audience we measure, to testify to their diffusion. It is inserted into the source code of the page. The tags that We use allow Us to check the effectiveness of the pages proposed and the operation of the Site, in a completely anonymous way.
"User" means any person browsing the Site.
"You", "Your" means the User of the Site.
II. What Data Do We Process and for What Purposes?
A. On the www.letour.fr website
We only collect the personal data we need to achieve the following purposes:
- Allow you to:
- Subscribe to the newsletters of A.S.O. and/or Our partners if You have consented to;
- Allow you to follow the Tour on the official pages of the Event in social networks;
- Share Your Videos and Photos content on TikTok;
- Our legitimate interest in ensuring the security of the Site: reCaptcha of the newsletter subscription form;
- Propose to you content or targeted advertising from Third Parties if You consent to the deposit of their Cookies. To learn more about how Cookies work on the Site, we invite You to read the Cookies Policy.
1. Data collected directly
We collect Your Data directly from You, in order to allow You to subscribe to newsletters.
a) Data collected during Your subscription to newsletters
When You want to follow all the news about the Tour de France, You can subscribe to Our newsletters. If You wish, You can also subscribe to those of Our partners. You will need to give Your consent each time.
To subscribe to newsletters, We need some of Your Data. The Mandatory Data is followed by an asterisk (*).
(1) Mandatory data
We collect so-called Declarative Data of which You are the sole source. The following Data are mandatory:
-Identity data
-Personal life data (language preferences)
(a) Identity data
To subscribe to the Tour de France newsletter, We need the following Identity Data. We will only ask You for Data that is strictly necessary for the purposes We follow:
-Civility
-Email
-Last name
-Name
-Date of birth
-Country
(b) Personal life data
Personal life data allows Us to know the language in which You prefer to receive the Tour de France newsletter or, if You have consented, that of Our partners.
Other Data is optional, and You remain free to provide it or not.
(2) Optional data
To respect for Your privacy, We only collect the Data necessary for sending the newsletter by email. For this reason, the following Identity Data is optional:
- Address
- City
Indeed, We send You the newsletter by email, so We do not need Your home address.
2. Data collected indirectly
Data collected indirectly is generally collected by Third Parties:
- Google: via the reCaptcha at the bottom of the newsletter registration form;
- Social Networks, through the Pixels that they deposit on the Site and that allow You to follow the Tour in the official pages of the Event in said Social Networks.
a) Connection Data : Google's reCaptcha
In order to preserve the security of the newsletter registration form, to fight the misuse of the Tour newsletter registration form by preventing bots (automatic software) and to protect against spam, We use the Google reCAPTCHA service at the bottom of the newsletter registration. In compliance with art. 6, paragraph 1, p. 1, lit. f GDPR, it protects Our legitimate interest in terms of security of our website as well the optimal display of our online presence.
Google reCAPTCHA is an offer from Google LLC: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (hereinafter "Google").
Google reCAPTCHA uses a code embedded in the website, called JavaScript, as part of the verification methods to analyze your use of Site, such as cookies. The information automatically collected about your use of this system, including your IP address, is usually transmitted to and stored on a Google server in the USA.
Further information on Google's data protection rules can be found at www.google.com/policies/privacy
b) Data collected by Social Networks when You follow the Tour on their official pages
A.S.O. allows you to follow the Tour through the official pages of the Event in social networks. This is the reason why we have implemented different buttons, each corresponding to the Social Network concerned:
- Facebook
- Instagram
- Twitter
- Dailymotion
- Tik Tok
(1) Facebook and Instagram buttons
Our Site has implemented a Facebook and Instagram button to allow you to visit the Facebook and Instagram pages of the Event, in which case Facebook is considered a Joint Controller. Indeed, Facebook collects Your Data as soon as You open a site in which this Facebook Pixel is located and tracks Your navigation through all the Sites.
Facebook Ireland is a Joint Controller and You can find all the information required by Article 13(1)(a) and (b) GDPR in the data policy of Facebook Ireland https://www.facebook.com/about/privacy.
Information about your use of the applicable products as well as the purposes for collecting and communicating the personal data constituting the joint processing take place in accordance with the applicable Product Terms.
Further information on how Facebook Ireland processes personal data, including the legal basis on which Facebook Ireland relies and the means available to data subjects to exercise their rights against Facebook Ireland, can be found in the Facebook Ireland Privacy Policy available at https://www.facebook.com/about/privacy.
However, once you are redirected to the Facebook page of the Event, Facebook becomes an "Independent controller" because Facebook is the only one to decide what data to collect, the purposes of the processing of Your data and You will have to contact Facebook to exercise your rights.
(2) Twitter button
Our Site has implemented a Twitter button to allow you to follow the Event on Twitter. In this case, Twitter is considered a Joint Controller. Indeed, Twitter collects Your Data each time You click on the Twitter button of Our Site.
Twitter is a Joint Controller and You can find all the information required by Article 13(1) (a) and (b) GDPR in Twitter's Privacy policy available at: https://twitter.com/en/privacy .
Information about your use of the applicable products as well as the purposes for collecting and communicating the personal data constituting the joint data processing take place in compliance with the applicable Product Terms.
Further information on how Twitter processes personal data, including the legal basis on which Twitter relies and the means available to data subjects to exercise their rights against Twitter, can be found in Twitter’ Privacy Policy available at https://twitter.com/en/privacy.
However, once you are redirected to the Twitter page of the Event, Twitter becomes an "Independent controller" because Twitter is the only one to decide what data to collect, the purposes of the processing of Your data and You will have to contact Twitter to exercise your rights.
(3) Dailymotion button
Our Site has implemented a Dailymotion button to allow you to follow the Event on Dailymotion videos. In this case, Dailymotion is considered a Joint Controller. Indeed, Dailymotion collects Your Data each time You click on the Dailymotion button on Our Site.
Dailymotion is a Joint Controller and You can find all the information required by Article 13(1)(a) and (b) GDPR in Dailymotion's Privacy policy available at: https://www.dailymotion.com/legal/privacy?localization=fr.
Information about your use of the applicable products as well as the purposes for collecting and communicating the personal data constituting the joint processing take place in compliance with the applicable Product Terms.
Further information on how Dailymotion processes personal data, including the legal basis on which Dailymotion is based and the means available to data subjects to exercise their rights against Dailymotion, can be found in Dailymotion's Privacy Policy available at https://www.dailymotion.com/legal/privacy?localization=fr.
However, once you are redirected to the Dailymotion page of the Event, Dailymotion becomes an "Independent controller" because Dailymotion is the only one to decide what data to collect, the purposes of the processing of Your data and You will have to contact Dailymotion to exercise your rights.
(4) Tik Tok Button
Our Site has implemented a Tik Tok button to allow you to follow the Event on videos shared on TikTok. In this case, TikTok is considered a Joint Controller. Indeed, TikTok collects Your Data each time You click on the TikTok button on Our site.
TikTok is a Joint Controller and You can find all the information required by Article 13(1) (a) and (b) GDPR in Tik Tok's Privacy policy on: https://www.tiktok.com/legal/privacy-policy?lang=en
Information about your use of the applicable products as well as the purposes for collecting and communicating the personal data constituting the joint processing take place in compliance with the applicable Product Terms.
Further information on how TikTok processes personal data, including the legal basis on which TikTok is based as well as the means available to data subjects to exercise their rights against Tik Tok, can be found in Tik Tok's Privacy Policy available at https://www.tiktok.com/legal/privacy-policy?lang=en.
However, once you are redirected to the TikTok page of the Event, TikTok becomes an "Independent controller" because TikTok is the only one to decide what data to collect, the purposes of the processing of Your data and You will have to contact Tik Tok to exercise Your rights.
B. On page www.letour.fr/fr/club
1. Data collected
On the www.letour.fr/fr/club page, We process Identity Data about You to allow You to log in to the Club, if You already have an account, or to register, if this is Your first visit.
a) Identity data
We will ask You for certain Data to allow You to:
- Log in to Your existing account;
- To register and create a new account.
(1) Connecting to an existing account
When You have an account, You can either enter in the Site, the following Identification Data:
- The email address: that You used to create Your account;
- The password: which You chose when you created Your account.
You also have the option to log in through Your Facebook or Google accounts.
(a) Login via Facebook
Our Site has implemented a Facebook button to allow you to log in using Your Facebook account. In this case, You are transferred to Your Facebook account and the latter is considered as "Independent Controller" because Facebook is the only one to decide what data to collect, the purposes of the processing of Your data and You will have to contact Facebook to exercise your rights. Indeed, Facebook collects Your Data from the moment You click on the Facebook button to connect to Our Site using Your Facebook account.
Further information on how Facebook Ireland processes personal data, including the legal basis on which Facebook Ireland relies and the means available to data subjects to exercise their rights against Facebook Ireland, can be found in facebook Ireland's Data Use Policy available at https://www.facebook.com/about/privacy
(b) Login via Google
Our Site has implemented a Google button to allow you to log in using Your Gmail account. In this case, You are transferred to Your Personal Gmail Space. In this case, Google is considered "Independent Controller" because Google alone decides what data to collect, the purposes of the processing of Your data and You will have to contact Google to exercise your rights. Indeed, Google collects Your Data from the moment You click on the Google button to log in to Our Site using Your GoogleAccount.
Further information on how Google processes personal data, including the legal basis on which Google relies and the means available to data subjects to exercise their rights against Google, can be found in Google's Data Policy available at: https://policies.google.com/privacy?hl=en-US
(2) Registering and creating a new account
When You do not yet have an account, You can create one.
We need You to provide certain Identification Data about You :
- Civility;
- Last name
- Name
- Nationality: this allows Us to propose to You content in Your language
- Date of birth: to be a fan of the Tour de France club, you must be of legal age.
- Email address: to which We will send You newsletters focused on Your interests, if You consent to them;
- The password, which must contain at least 8 characters including a special character. We advise You to create strong passwords, following the recommendations of the CNIL or ANSSI. A strong password protects you against data breaches related to your email address.
- Confirmation of the password.
When You register, You receive an email in the email address provided for the purpose of validating Your email address. In this way, We make sure of Your identity.
(3) Connection data
In general, We only collect the following connection data during Your session:
- Information about Your device's browser and the operating system You use;
- The web pages You visit;
- Links that You click on while You are browsing the Site;
- Authentication history;
- More information is Given on this subject, in particular on the retention periods, within our Cookies Policy
III. Use of Your Data: Purposes
We only use and process data that is relevant to the following purposes:
- Allow you to register for a club of fans and enthusiasts of the Tour de France;
- Send you newsletters of other events organized by A.S.O. or commercial offers from Our partners, if You consent by ticking the respective boxes;
- Propose services and personalized content (videos, press articles, etc.);
- Allow you to follow the Tour or other amateur or professional cycling events on social networks;
- Confirm the creation of your account;
- Allow you to know Our partners and the boutique of the Tour in order to acquire the products that make You happy.
- Guarantee the security of the Site;
- Fight against fraud;
- Any other purpose for which We will ask You for Your Consent, if necessary.
1. Recipients of Your Data
We share Your Data with Our Data Hosting Processor.
If You are redirected to a Third-Party Site, Your data will be processed by that Third Party Site. This can be the Social Networks or the Website of the Boutique du Tour. In this case, the publishers of the Third-Party Sites will be the Data Controllers.
a) The host of the Site: Skale-5
The Site is hosted by:
SKALE-5 which is located at 33 Avenue des Champs Elysées, 75008 PARIS
Skale-5 has given ASO and the Amaury Group all the guarantees in terms of security and data protection.
The host of the Site has undertaken to A.S.O.to host Your Data within the European Economic Area.
b) Social Networks
As We have specified in Chapter B.1 of this Policy,from the moment You choose to log in to Your account through Your Facebook or Google accounts, You are redirected to their Sites and ASO is no longer the Data Controller of Your Data.
A.S.O. cannot control the Data Processing made by Social Networks when You are redirected to their sites and therefore cannot be held responsible for any misuse on their side. We strongly recommend that You carefully read the Privacy Policies or Statements of each of the Social Networks in order to be able to know how they use Your Data and how to exercise Your rights.
c) Redirecting to Third Party Sites, Boutique du Tour
A.S.O. allows you to benefit from offers on services and products sold by the boutique du Tour whose Site is not managed by A.S.O. The boutique du Tour Site is a Third-Party site to which You are redirected as soon as You click on the "boutique" button to access it.
A.S.O. cannot be held responsible for any problem whatsoever involving Your relations with the Boutique of the Tour Site.
When You access a Third-Party Site, You leave the A.S.O. Site and the publisher of the Third Party Site becomes the Data Controller.
A.S.O. cannot vouch for the way in which the Site of the Boutique du Tour processes Your Data. We invite You to read their Privacy Policy, available at https://boutique.letour.fr/fr/le-tour-privacy-policy/ch-2822
IV. Consent, the legal basis to Process Your Data
We do not sell or rent Data to Third Parties. We use your data in strict compliance with applicable personal data protection law. You remain the sole master of the use of Your Personal Data by giving or withdrawing Your consent at any time:
- When You register;
- When You subscribe to the newsletters.
(1) Subscription to newsletters
When You register, You are also asked if You wish to receive newsletters from A.S.O. or from Our partners.
Each time, We ask for Your Consent.
It will always be possible for You to unsubscribe by clicking on the link at the bottom of the newsletter.
V. Retention of Your Data
We have implemented the principle of minimization of Your Data and We keep Your Data only for the time necessary to fulfill the Purposes here described.
We keep Your Data for a period of 3years. Once the 3-year deadline has expired, We securely delete Your Data and ask Our Data Processors to do the same.
VI. What are Your rights and How can You exercise them?
IV.1 Your rights
In compliance with the applicable Laws and Regulations on the protection of personal data, and in particular with the French Data Protection Act No. 78-17 of 6th January 1978 as amended by the French Data Protection Act No. 2018-493 of 20th of June 2018, and EU Regulation 2016/679, the User of the Application has the right to access, rectify, delete, limit the processing, object to and limit the Data Processing, in compliance with articles 15 to 21 of the GDPR.
You also have the right to refuse to be the subject of an automated individual decision taken based on Your Data, in accordance with Article 22 of the GDPR.
IV.2 How can You exercise them?
You can exercise Your rights by filling in the form, accessible on: https://www.letour.fr/en/request-management
We inform You that, in compliance with Article 12 of the GDPR, We may ask You for a copy of a document attesting to Your identity, in order to verify that Your identity has not been usurped.
Finally, you have the right to lodge a complaint before the Commission Nationale Informatique et Libertés (CNIL) if You think that We do not respect Your rights.
