Privacy policy

Cœur Voyage attaches great importance to protecting the personal information of its visitors. This policy sets out, transparently, what data we collect, why, how long we keep it, and how you can exercise your rights.

It applies in accordance with the Act respecting the protection of personal information in the private sector (Loi sur la protection des renseignements personnels dans le secteur privé, Law 25, Quebec) and, for visitors from the European Union, with the General Data Protection Regulation (GDPR, EU 2016/679).

Data controller

The controller of the data processing is the publisher of the Cœur Voyage website. Full contact details are given in the legal notice.

Person in charge of the protection of personal information: Olivier Lange — contact@coeur-voyage.com.

Data collected

Browsing data (statistics)

We use an analytics tool to understand how visitors use the site (page views, time spent, traffic source). The data collected is:

• IP address (anonymized or truncated)
• browser type and operating system
• pages visited, visit duration, path through the site
• referring site (the link that brought you here)
• country / region (inferred from the IP address)

Tool used: Google Analytics 4 (measurement ID G-HYS5MYVT9V), provided by Google LLC. These cookies are only set after your explicit consent: until you have accepted, no audience measurement takes place. You can change this choice at any time through “Manage my privacy preferences” in the footer.

Forms and emails

When you write to us (contact page or direct email), we process the data you send us voluntarily: name (or pseudonym), email address, message, and any additional information you include.

Member account

Reading the site requires no account: all articles are freely accessible. If you create an account, we process the following information, and only that.

What you give us

• An email address — to confirm that the account is indeed yours, to let you sign in and to recover a forgotten password. It is never displayed publicly.
• A pseudonym — the only name publicly associated with your contributions. We do not ask for your legal name: the site has no use for it, and data that is not collected is data that can neither be lost nor disclosed.
• A password — never kept as such: only an irreversible cryptographic hash is. No one, ourselves included, can read it back.

What we record in order to prove your consent

When you tick a box at sign-up — acceptance of the terms of use, choosing whether or not to receive the newsletter — we record what you ticked, when, from which form, under which version of the text, together with your IP address and your browser.

Those last two pieces of information serve no other purpose. They are there because Canada's anti-spam legislation (loi canadienne anti-pourriel, CASL) requires us to be able to demonstrate that consent was indeed given, which a ticked box alone does not allow: we must be able to say when, and to what. This register is never modified — a withdrawal of consent is added to it as a new line, it does not erase the previous one. You can view it in full from your account.

What we record in order to keep you signed in

Each sign-in opens a session, recorded with its date, its IP address and its browser, so that you can recognize your own devices and so that we can cut off access immediately if necessary. The session token itself is kept only as a hash: reading our database does not allow anyone to sign in as you.

What you store there yourself

Your favourite articles form a private list: it is visible only to you, and it triggers no email.

Comments and interactions

People who have a member account may comment on articles. The system is internal to the site: no third-party service such as Disqus, and no comment data is passed on to anyone.

What we keep for a comment: the pseudonym you chose (never your legal name, which we do not ask for), the text, the date, and the link with your account. The pseudonym and the text are public once the comment is published; nothing else is.

Comments are reviewed before publication. You can follow the status of your own from your account, and ask for them to be removed at any time. If you delete your account, your comments are anonymized rather than destroyed: a public discussion does not belong to its last participant alone, and threads full of holes become unintelligible to the other participants. Nothing then connects them to your identity any more.

Protection against automated submissions relies on a trap field and on how long the form takes to fill in — no CAPTCHA, and no transmission of your text or your IP address to a third-party service for that purpose.

Purposes of the processing

• Audience statistics: understanding which content interests our readers and improving the site.
• Answering requests: handling the emails and messages you send us.
• Managing your account: authenticating you, keeping you signed in from one visit to the next, letting you find your favourites and your contributions again, and letting you exercise your rights without having to write to us.
• Proof of consent: being able to demonstrate, should a complaint arise, what you accepted and when.
• Security: preventing attacks (spam, intrusion attempts), by way of security logs.
• Legal obligations: keeping minimal logs in the event of a judicial order.

We never sell your data. We pass it on to third parties only in the cases listed below.

Legal bases

• Performance of the contract (GDPR art. 6.1.b) — for the creation and management of your member account, the rules of which are set out in our terms of use.
• Consent (Law 25 / GDPR art. 6.1.a) — for audience-measurement and marketing cookies, and for sending the newsletter if you asked for it.
• Legitimate interest (GDPR art. 6.1.f) — for the security of the site and the prevention of fraud.
• Performance of pre-contractual measures (GDPR art. 6.1.b) — to answer your contact requests.

Cookies and trackers

The site uses cookies to operate and to measure its audience. Two categories:

• Strictly necessary cookies: no consent is required for these, because the site cannot work without them.
  • cv_consent — remembers your choice to accept or refuse audience measurement, so as not to ask you again on every visit. Duration: 13 months.
  • cv_membre_session — keeps you signed in to your account. It is set only after a successful sign-in, it cannot be read by the page's JavaScript, and it disappears on sign-out. Maximum duration: 30 days.
• Audience-measurement cookies: set by Google Analytics 4 (_ga, _ga_HYS5MYVT9V) only after your acceptance, and kept for 13 months at most. Your choice itself (acceptance or refusal) is remembered for the same period, so as not to ask you again on every visit.

You may withdraw your consent and delete cookies at any time through your browser settings.

Retention periods

• Audience statistics: 13 months at most for cookies, 25 months for aggregated data.
• Emails and forms: kept for as long as needed to answer, then archived for 3 years for evidentiary purposes, then deleted.
• Server logs: 12 months at most (except where a security incident extends that period for investigation purposes).
• Member account: kept as long as you use it. After 24 months without a sign-in, we notify you by email and delete the account 30 days later if you have not signed in again by then.
• Proof of consent: kept for 3 years after the end of the relationship, being the period during which we may have to demonstrate what was consented to. The IP address and browser they contain are erased as soon as the account is deleted.
• Sessions: a session expires no later than 30 days after it is opened, and it is cut off immediately on sign-out as well as on deletion of the account.
• Password reset requests: the link expires in 1 hour; the record of the request is deleted after 30 days.

Recipients of the data

• The editorial team of Cœur Voyage (Olivier and Marilou).
• Our web host (OVH SAS, see the legal notice).
• Our technical service providers:
  • Google LLC, for the audience measurement described above and nothing else, and only if you have accepted it.
  • Resend, for delivering our emails (address confirmation, password reset, notifications you have asked for). Resend receives your email address and the content of the message, for delivery only.

  We use no third-party content delivery network, no advertising network, and no external comment-analysis service.

• The competent authorities, in the event of a legal order.

Some of our service providers may process your data outside Quebec or the EU. This is the case for Google LLC for audience measurement — that transfer rests on your consent and on Google's standard contractual clauses — and for Resend for the delivery of our emails: your email address passes through that service, established in the United States, every time we write to you. These transfers are limited to what is necessary for those two uses. No article content, no list of favourites and no account data other than the recipient address is transmitted to them.

Your rights

You have the following rights:

• Access — to know what data we hold about you.
• Rectification — to correct inaccurate data.
• Erasure (right to be forgotten) — to ask for your data to be deleted.
• Objection — to refuse a processing operation, in particular for audience-measurement purposes.
• Portability — to receive your data in a structured format.
• De-indexation (Law 25) — to ask that information concerning you cease to be disseminated.
• Withdrawal of consent — at any time, without retroactive effect.

If you have an account, the essentials are self-service in your account, without writing to us and without delay:

• Access — “Export my data” hands you, immediately, a file containing everything the site holds about you: profile, full history of your consents, favourites, sessions, contributions and ratings.
• Rectification — you change your pseudonym and your sending preferences yourself. Changing the email address goes through us, because it requires verifying the new address.
• Erasure — “Delete my account” takes effect immediately (see below).

For everything else — objection, de-indexation, a question about a processing operation, or if you have no account — write to contact@coeur-voyage.com setting out your request. We answer within 30 days.

Deleting your account: what is erased, what survives

Deleting your account erases your email address, your password, your pseudonym, your profile, your favourites and your sending preferences. All your sessions are cut off on the spot and the account becomes inaccessible. Proof of your past consents is kept — that is a legal obligation — but depersonalized: the IP address and the browser are erased from it.

Your already published public contributions are not erased: they are anonymized. They stay online, detached from you, under the mention “Deleted member”.

Why this choice rather than erasure: a public discussion does not belong to its last participant alone. Erasing one person's messages makes the replies others made to them unintelligible, and erases those people's contribution along with theirs. Anonymization achieves the result that concerns you — nothing connects you to that text any more — without tearing holes in other people's discussion.

If you also want a specific contribution removed, ask us at contact@coeur-voyage.com: we will do it.

Remedies

If you consider that your rights are not being respected, you may refer the matter to:

• in Quebec: the Commission d'accès à l'information (CAI).
• in France / the EU: the CNIL or the supervisory authority of your country of residence.