1. Who we are
Colpasso provides curated Pyrenees cycling route information for riders and participating retailers in the Hautes-Pyrénées. This Privacy Policy explains how we collect, use, store, and protect personal data when you use the Colpasso website and related services (the "Service").
Colpasso is operated from France. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French data protection law.
2. Personal data we collect
2.1. Data you provide
- Email address when you unlock a route via a sticker QR code, register interest as a retailer, subscribe to our newsletter, or contact us.
- Account and business details if you are an approved retailer (business name, contact details, login credentials, order history).
- Messages and information you send us through forms or email.
2.2. Data collected automatically
- Technical and usage data such as IP address, browser type, device type, pages visited, and approximate location derived from IP.
- Session and security data needed to operate the Service (for example login sessions and CSRF protection).
- Cookie and similar technology data as described in our Cookie Policy.
We do not collect precise GPS location from your device unless you choose to share location with a third-party map service linked from the website.
3. How we use personal data
- To provide route and climb information, maps, GPX access, and sticker unlock services.
- To manage retailer accounts, sticker orders, and partner communications.
- To send service messages such as route access links, security notices, and support replies.
- To improve the website, fix errors, and understand how the Service is used.
- To prevent fraud, abuse, and unauthorised access.
- To comply with legal obligations.
- To send marketing communications where you have opted in and where permitted by law.
4. Legal bases for processing
Depending on the activity, we rely on one or more of the following legal bases:
- Performance of a contract or steps at your request before entering a contract (for example providing route access after sticker registration).
- Legitimate interests (for example securing the Service, improving content, and operating retailer tools), balanced against your rights.
- Consent (for example optional newsletter subscription or non-essential cookies where required).
- Legal obligation (for example record-keeping required by law).
For a detailed explanation of your GDPR rights, see our Your data rights page.
5. Sharing personal data
We do not sell your personal data. We may share data with:
- Hosting, email, analytics, and infrastructure providers that help us run the Service under contract.
- Participating retailers only to the extent needed to fulfil a sticker purchase or unlock you initiated with them.
- Authorities or advisers where required by law or to protect rights, safety, and security.
Third-party analytics may be loaded through Google Tag Manager. See our Cookie Policy for more detail.
6. International transfers
Some service providers may process data outside the European Economic Area. Where this happens, we use appropriate safeguards such as Standard Contractual Clauses or other mechanisms recognised under GDPR.
7. Retention
We keep personal data only for as long as needed for the purposes described above, including to meet legal, accounting, or reporting requirements. When data is no longer required, we delete or anonymise it.
8. Security
We apply appropriate technical and organisational measures to protect personal data. No online service can guarantee absolute security, but we work to reduce risk through access controls, secure hosting, and careful handling of credentials and route access.
9. Your rights
Under GDPR and French law you may have the right to access, rectify, erase, restrict, object to, or port your personal data, and to withdraw consent where processing is based on consent.
You can also lodge a complaint with the French supervisory authority, the CNIL, at cnil.fr.
See our Your data rights page for how to contact us about a request.
10. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date.
12. Contact
Questions about this Privacy Policy can be sent via our About Colpasso page.