1. Who we are
This website djerba-sensations.com is published by SARL Djerba Sensations, a tourist activity booking platform based at 4116 Djerba Midoun, Tunisia.
Djerba Sensations is the data controller for the personal data collected via this website, within the meaning of the General Data Protection Regulation (GDPR).
Why does the GDPR apply even though the company is based in Tunisia?
The GDPR applies as soon as a website offers its services to individuals located in the European Union — which is our case, since our website is translated into several European languages and targets a European clientele. We therefore apply the same safeguards as a company based in the EU.
2. What data do we collect?
We only collect the data necessary to process your requests and bookings:
| Situation | Data concerned |
|---|
| Contact form | First name, last name, email, phone number, message |
| Booking an activity | First name, last name, email, phone, date and activity chosen, number of participants, accommodation location (for transfer purposes), any additional information you provide |
| Online payment | Your banking details (card number, etc.) are entered directly on the secure page of our payment partner Flouci (Kaoun SARL). We never collect or store your banking details on our servers. |
| Browsing the website | IP address, device and browser type, pages viewed (via technical cookies, see section 8) |
| WhatsApp exchanges | Phone number and content of messages exchanged, as part of organising your activity |
We never collect sensitive data (origin, health, political or religious opinions, etc.), unless you voluntarily provide it yourself (for example, medical information relevant to safety during a physical activity).
3. Why do we collect this data?
- To process and confirm your booking requests
- To organise the transfer from your accommodation and ensure the activity runs smoothly
- To answer your questions via the contact form or WhatsApp
- To manage payment for your activity
- To comply with our legal and accounting obligations
- To improve our website and services
We never use your data for marketing purposes without your prior consent.
4. On what legal basis?
- Performance of a contract: when you book an activity, processing your data is necessary to provide that service
- Legitimate interest: to respond to your enquiries and ensure the website functions properly
- Legal obligation: for retaining certain documents for accounting and tax purposes
- Consent: for the use of certain non-essential cookies, where applicable (see section 8)
5. Who has access to your data?
Your data is never sold or rented to third parties. It may only be shared with:
- The Djerba Sensations team, for organising your activity
- Our service-provider partners (activity centres, drivers, guides) strictly to the extent necessary to carry out your activity (name, number of participants, pick-up location)
- Our payment partner Flouci (Kaoun SARL), for the secure processing of your online payment
- Our web host OVH, which technically stores the website's data
- Google (Google Analytics), for anonymised website audience measurement, only if you have given your consent via the cookie banner
- WhatsApp (Meta), when you choose to communicate with us via this messaging service — use of WhatsApp is then also subject to Meta's privacy policy
6. Where is your data stored?
The website and database are hosted by OVH, in France (Gravelines data centre), within the European Union.
Your data therefore directly benefits from GDPR safeguards at the technical storage level, even though Djerba Sensations is based in Tunisia.
7. How long do we keep your data?
- Contact requests with no follow-up: kept for a maximum of 12 months, then deleted
- Booking data: kept for the duration of the business relationship, then archived for the legal retention period applicable to accounting and commercial documents
- Banking data: never kept by Djerba Sensations (processed directly via the Flouci payment gateway)
8. Cookies and trackers
Our website uses essential technical cookies required for it to function properly (navigation, remembering your language preferences, site security, booking engine functionality). These cookies do not require your consent as they are essential.
We also use Google Analytics, an audience-measurement tool that helps us understand how visitors use our website (pages viewed, time spent, geographic origin) in order to improve our content and services. This data is anonymised and does not allow us to identify you personally.
In accordance with the GDPR, a cookie consent banner is displayed on your first visit. You can, at any time:
- Accept all: allow all cookies, including audience-measurement cookies
- Reject all: only essential technical cookies will remain active
- Customise your cookie preferences individually
Audience-measurement cookies are only placed after your explicit consent via this banner — never before. You can change your choice at any time by clearing your browser's cookies, which will bring the consent banner back up.
We do not currently use any advertising or marketing-targeting cookies (such as Meta/Facebook Pixel). Should this change, this policy will be updated accordingly.
9. Security of your data
We implement reasonable technical measures to protect your data: secure connection (HTTPS), restricted access to authorised personnel, hosting with a professional provider (OVH). Card payments are handled entirely by the secure gateway of our payment partner Flouci, in accordance with current security standards.
10. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access: to know what data we hold about you
- Right to rectification: to correct inaccurate data
- Right to erasure: to request deletion of your data
- Right to restriction of processing
- Right to object to the use of your data
- Right to data portability
- Right to withdraw your consent at any time, where processing is based on it
To exercise any of these rights, contact us by email at contact@djerba-sensations.com. We will respond within a reasonable timeframe.
If you reside in the European Union, you also have the right to lodge a complaint with the data protection authority in your country of residence (for example, the CNIL in France).
11. Data concerning children
Some of our activities may be enjoyed as a family, with children. In such cases, information relating to a minor (first name, age) is always provided by a parent or legal guardian at the time of booking, and is only used for organising the activity (minimum age verification, safety).
12. Changes to this policy
This privacy policy may be updated, particularly in the event of changes to the website or applicable regulations. The date of the last update is shown at the top of this page. We invite you to review it periodically.
