Privacy policy

Last updated: September 2026

Who we are

The data controller is Heather Couthaud, sole proprietor trading as Two Poppies Tours. For any question about your data: heather@two-poppies.com.

What we collect

We collect your email address if you subscribe to the Coquelicontes newsletter, with a record of your consent (date, time, IP address). We also gather what you write to us when planning a tour: your name, contact details, dates, and anything you choose to share so we can adapt the visit to you (for example, a question of mobility). For a booking, we collect the travelers’ names, contact details, and what is needed for invoicing.

Health and mobility information

If you choose to tell us about a health condition, mobility limits, allergies or dietary needs, we use this information only, with your explicit consent, to prepare and run your tour. We share only what is strictly necessary with the restaurants or partners concerned, and we delete it no later than three months after the tour. You may withdraw your consent at any time.

Why we collect data

The newsletter is based on your consent, which you can withdraw at any time through the unsubscribe link in every issue. Inquiries and bookings are processed to prepare and carry out the contract you wish to enter into with us. Accounting records are kept to meet our legal obligations.

Who receives your data

We never sell or rent your data. It is processed by our service providers: MailerLite (Lithuania, EU) for the newsletter; Proton AG (Switzerland, a country recognized as offering adequate protection) for our email; Cloudflare, Inc. (United States, a participant in the EU–U.S. Data Privacy Framework) for hosting the site, which processes technical connection data such as IP addresses. To run a tour, we share only what is strictly necessary with the partners involved (transport, restaurants, sites visited).

How long

Newsletter: we keep your data until you unsubscribe. Correspondence: we keep inquiries that do not lead to a booking for three years after the last contact. Bookings and invoices: we keep booking and invoicing data for ten years, as the law requires.

Cookies

This site uses no cookies, no audience-measurement tools, and no advertising trackers.

Your rights

You may access, correct, or delete your data, restrict or object to its processing, request a portable copy, and withdraw your consent, by writing to heather@two-poppies.com. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).