Privacy and cookie policy

1. What we collect, and why

• Your search preferences (departure city, moods, favourites, compared parks) are stored only in your browser (localStorage). They are never transmitted to us and disappear if you clear the site's data.
• Price and availability alerts: your email address, the park and threshold chosen, the sign-up date and your IP address (anti-abuse). Legal basis: your consent. Retention: until you unsubscribe (link in every email) or 24 months without activity.
• Newsletter: your email and your departure city. Legal basis: consent. You can unsubscribe via the link in every mailing, or by email.
• Contact form: your email address, your name if you provide it, the reason, the content of your message and your IP address (anti-abuse and rate limiting). Legal basis: your consent, ticked in the form. Sole purpose: to reply to you. Retention: 12 months maximum. Your messages are never used to sign you up to a mailing list and are not passed on to anyone.
• Outbound clicks to operators: we count clicks per park, without any personal identifier, to measure how useful the service is. Like the audience measurement described below, this counting drops no cookies, creates no visitor identifier and keeps no IP address: it therefore does not require your consent.
• Audience measurement: on each page view, your browser sends our server the path of the page and the domain of the site that brought you here (for example “google.com”, never the full address or your search). We keep only a counter from this: for each day, the number of views per page and per referring domain. No cookie is placed, no visitor identifier is created, no IP address is recorded, and two visits on the same day to the same page are indistinguishable. These counters therefore make it possible neither to recognise nor to distinguish anyone: they are not personal data, and this measurement does not require your consent (it neither reads nor writes anything on your device). Retention: the monthly counters, indefinitely, since they are anonymous.
• Server logs (Hostinger): IP address, page viewed, browser, kept for a maximum of 30 days for security.

2. Third-party services

• Open-Meteo (weather): your browser queries their API directly with the park's coordinates, without any personal data.
• OpenStreetMap and Leaflet (base maps and display library): loading the tiles and the map resources transmits your IP address to the OpenStreetMap Foundation and to the delivery network used by Leaflet. Driving times are calculated in advance on the server side (OSRM): your browser does not contact this service.
• Wikimedia Commons (real photos of the places) and Unsplash (mood illustrations): loading the images transmits your IP address to these services.
• Affiliate networks (Awin, TradeTracker): none is active today — our applications are under review — so no affiliate cookie is set when you click through to an operator. The day one is, the network will set a cookie on the operator's site to attribute a possible commission (usually lasting 30 days), and this page will say so beforehand. Their policies: awin.com/privacy, tradetracker.com/privacy-policy.
• Google AdSense (advertising): Google's script is present in the page as soon as you arrive, but it is held back until you have accepted. In practice: your browser does contact Google's servers to load this script, but in the thirty-two countries listed below, until your consent has been given, no advertising cookie is dropped, nothing is read from your device and no identifier is associated with you. This is a change from the previous version of this page, where the script was simply not there at all before you made your choice: we would rather say so than let you believe that the two situations are equivalent. If you accept, Google and its partners may place cookies to measure and target ads; you can also adjust personalisation at adssettings.google.com. Policy: policies.google.com.
• Google Analytics 4: when it is enabled, it is loaded like the other Google scripts and subject to the same consent settings — storage for statistical purposes remains “denied” until you have accepted. It does not replace our internal counter, which remains the site's reference measurement.
• Internal Audience measurement: it is handled by our own server (see point 1), with no third-party service, and does not depend on any consent.
• Hostinger (hosting of the site and of the small alerts, newsletter and contact service): processor within the meaning of the GDPR.

3. Cookies and consent

What we store in your browser, and which is not a cookie: your favourites, the parks added to the comparison tool, your departure city and your search preferences are kept in localStorage. These data remain on your device and are not sent to any server. You delete them by clearing the site's data in your browser.

Who asks for your consent. The consent window is no longer a banner written by us: it is Google's message, coming from AdSense's “Privacy & messaging” tools. It is a consent management platform certified by Google and registered with the TCF v2.2 framework, which Google requires of publishers that display its ads to visitors from the European Economic Area, the United Kingdom and Switzerland. An in-house banner, however honest, does not meet that requirement: this is the reason for the change. Your choice is stored by this Google mechanism, under its own terms, so that you are not asked again on every page.

How Google's scripts are held back before you make your choice. Before any Google script runs, the page sets Google's "Consent Mode v2" with default values of "denied" in the thirty-two countries where consent must be obtained beforehand: the twenty-seven European Union member states, Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland.

• The four consent settings: advertising-related storage, advertising data about you, ad personalisation and statistics-related storage are all set to “denied” until you have accepted.
• Two additional safeguards: on top of these four settings, the data sent to Google's advertising services is redacted while consent is missing, and referrer information is passed through the page address rather than through a cookie.
• Until you have made a choice, or if you decline: Google's scripts are loaded, but they write no cookie, read nothing from your device and send no identifier relating to you. The site remains fully usable, no feature is removed, and you are not prompted again.
• If you accept: the settings switch to “granted”, and Google and its partners can then drop cookies and measure ads.
• Changing your mind: the “Advertising: change my choice” link in the footer reopens Google's message, at any time and in both directions.

hoprat uses no cookie of its own. Our internal audience measurement and the counting of outbound clicks (point 1) drop no cookies, read nothing from your device, create no visitor identifier and keep no IP address: they therefore do not fall under consent and remain active in both cases. The cookies that may be set come from Google's services once you have accepted them, and from Google's consent mechanism itself, which has to store your choice. As no affiliate network is active to date (point 1), no affiliate cookie is dropped.

4. Your rights

You may request access to, rectification of, erasure of or portability of your data, and object to its processing, by email to the address above. We reply within 30 days. You may also lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be).

5. Security and transfers

The alerts and newsletter data, as well as the audience counters, are stored on the Hostinger server (European Union), in a folder that is not publicly accessible; the audience counters are never published. Google (AdSense, its consent mechanism and, when it is enabled, Google Analytics) may process data outside the EU under its standard contractual clauses.

6. Contact us

For any question about this policy or to exercise your rights: contact@hoprat.com, or via the Contact page. Postal address: Holliday Pratique, Rue Auguste Ponson 69/2A, 4020 Jupille-sur-Meuse, Belgium.