Notice – Protection of personal data

Orange Link is committed, within the scope of its activities and in accordance with the legislation in force in France, Europe and other jurisdictions where it operates, to ensuring the protection, confidentiality and security of the personal data of the users of its services, as well as to respecting their privacy. This Policy informs you about how Orange Link, its contractors and partners process your personal data. This Policy applies in particular to customers and users of the offers and services as well as to visitors to the https://travel.orange.com/ website and users of the Orange Travel mobile application. It may be supplemented by specific information brought to the user’s attention in relation to a particular offer or service.

In what capacity does Orange Link process your data?

Orange Link processes your data in its role as data controller when:

You browse the websites or applications published by Orange Link, create an Orange Travel account, or contact Orange Link through the contact channels made available by Orange Link;
You subscribe to an offer or purchase a product or service designed and distributed on its own behalf by Orange Link. This is the case, for example, of the Welcome Travelers offers designed and distributed by Orange Link as an electronic communications operator.

In the case of data processing for which Orange Link is the data controller, it may rely on service providers who act on its behalf as subcontractors. In such cases, Orange Link ensures that its relations with subcontractors are governed by the applicable legislation on the protection of personal data. It should be noted that Orange Link also distributes products and services of partners, electronic communications operators as a reseller through its website. This includes, for example, the Holiday offers of the operator Orange France. When you subscribe to partner offers through Orange Link, you are informed that these partners are responsible for processing your data in the context of your contractual relationship with them. They process your personal data in accordance with their own privacy policies and you should contact them directly if you wish to exercise your rights

Why does Orange Link process your data?

Orange Link processes personal data only for specified, explicit and legitimate purposes. Orange Link does not process such data in a way that is incompatible with these purposes. Orange Link processes your data for the purpose of performing a contract. To this end, the purposes pursued by Orange Link are the following:

To manage the identity of the customer or user and to authenticate them
To manage the order
To invoice and collect payments
To provide pre-sales service and sales
Provide after-sales service
Process cancellations
Handle complaints
Communicate for customer management purposes

The retention period of your personal data processed for the purpose of contract execution in compliance with French regulations is 5 years from the end of the validity of the contract between Orange Link and you for civil identity data Orange Link also processes data for purposes other than the performance of the contract. When this is the case, Orange Link ensures, according to the appropriate legal basis, that it has a legitimate interest or that it obtains your consent, which you may withdraw at any time. To this end, the purposes pursued by Orange Link are the following:

To organize direct marketing operations
To organize contests
To survey customers or users
To ensure the security of the platforms and services
To fight against fraud

The retention period of your personal data processed on the basis of Orange Link’s legitimate interest or your consent is limited to the time necessary to achieve the specified purposes. Finally, Orange Link processes your data in order to meet its legal or regulatory obligations as follows:

Responding to requests from the authorities and to court orders
Responding to the authorities’ right to communicate.

Your data is kept for the time necessary to enable Orange Link to meet its legal obligations (for example, 1 year sliding scale for traffic and location data)

What data is processed?

Orange Link processes your personal data, which is collected directly from you when you create an account, purchase a SIM/eSIM card or buy top-ups. Orange Link may also receive data that has been collected from you by a third party, for example when you purchase an Orange Link product from a distributor. Orange Link will only process data or a category of data if it is strictly necessary for the purpose for which it was collected. You can find information on these purposes above. Orange processes the following categories of data:

Identification data: name, first name, IP address
Personal characteristics: title, date of birth
Contact data: telephone number, postal address
Connection and usage data: connection and usage logs
Economic and financial data: transaction number
Products and services owned or used
Content data: identification document

Who will receive the data?

The data collected is intended for Orange Link’s internal departments and its subcontractors. Data may also be processed by Orange Link’s partners. This mainly concerns situations in which partners are involved in the provision of services. Finally, the processed data may be transferred to the competent authorities, at their request, in the context of legal proceedings, in the context of legal investigations and requests for information from the authorities or in order to comply with other legal obligations.

How does Orange Link handle international data transfers?

Regarding data from the European Economic Area: Data collected by Orange Link within the European Economic Area (EEA) may be processed outside the EEA. In this case, Orange Link takes the necessary measures with its subcontractors and partners in order to guarantee an adequate level of protection of your data, in full compliance with the applicable regulations. If the subcontractors and partners concerned are not located in a country whose legislation is considered to offer adequate protection, they will have signed the European Commission’s “standard contractual clauses” or will be subject to internal binding rules approved by the authorities. Concerning the citizens of other regions of the world: Where Orange Link implements international data transfers from a jurisdiction other than the European Economic Area, Orange Link will ensure that it complies with the legal requirements governing international data transfers in the relevant jurisdiction.

What are your rights and how to exercise them?

You have the right to access, rectify and delete data concerning you. You can ask for the portability of the latter. You also have the right to object to the processing carried out or to request its limitation. You can issue directives on the conservation, deletion or communication of your personal data after your death. You may exercise your rights at any time, as well as contact the Orange Link Data Protection Officer via the following contact form: https://travel.orange.com/en/contact/. Orange Link reserves the right to ask you for proof of identity when this is necessary not only to ensure that you are really the originator of the request to exercise the right but also to protect the rights of third parties. The proof of identity will only be kept for the time necessary to process your request. Following your request, a reply will be sent to you within one month of receipt of your request. If you are not satisfied with the response you receive from Orange Link, you have the right to refer the matter to the French National Commission for Information Technology and Civil Liberties.

How is your data secured?

Orange Link ensures that your data is treated securely and confidentially, including when certain operations are performed by subcontractors. To this end, appropriate technical and organizational measures are put in place to prevent the loss, misuse, alteration and deletion of your personal data. These measures are adapted according to the level of sensitivity of the data processed and according to the level of risk that the processing or its implementation presents.