Privacy policy
Heritage Visits collects as little data as possible. There is no advertising tracker, no Google Analytics and no profiling: audience measurement is anonymous and cookie-free, and third-party services that set cookies only load with your consent.
Who is responsible
The data controller is the publisher of the site, GST LABS, 65 quai Joseph Gillet, 69004 Lyon, France. Full details are in the legal notice. You can reach us at hello@heritagevisits.com.
What we collect
Anonymous audience measurement
To know which pages are read, we use Matomo, installed on our own server: no data is passed to a third party. It works without cookies, your IP address is anonymised (the last two bytes are masked) and the Do Not Track setting of your browser is respected. The statistics are aggregated and only used to improve the site.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
Server logs
Our server keeps standard access logs (IP address, page requested, browser, date and time) for security and troubleshooting. They are kept for 30 days at most and are not used to analyse behaviour.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
If you write to us
When you email us, we receive your email address and your message. They are only used to answer you, are never passed on, and are deleted once the exchange is over, or sooner on request.
Legal basis: our legitimate interest in answering the messages we receive (Article 6(1)(f) GDPR).
Cookies and third-party services
On your first visit, a banner asks whether you accept third-party services. Until you accept, none of them loads. You can change your choice at any time with the round button at the bottom left of every page.
Cookies set by the site
- hv_consent: remembers your choice about third-party services and its random identifier, for 6 months.
- wordpress_* and wp-settings-*: technical session and display settings, only if you log in to the site administration.
Proof of your choice
To be able to prove the choice you made, we store it on our server with a random identifier (shown under “Customize”), the date, the banner version, the language and the page. Neither your IP address nor your browser is recorded. These records are deleted automatically after 12 months.
Third-party services, subject to your consent
- Stay22: maps of places to stay near a museum or a monument. Once loaded, Stay22 may set cookies and receive browsing data (IP address, page viewed) to show accommodation and attribute a commission.
- YouTube (Google), Vimeo and Google Maps: videos and maps embedded in a page. Once loaded, they may set cookies or use your browser storage.
If you decline, maps of places to stay, videos and embedded maps are replaced by a box that lets you display them later.
Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
Map background
The maps of places, cities and the general map draw their background from OpenFreeMap, a free map service that requires no account or key. When a map comes into view, your browser downloads the map tiles from OpenFreeMap’s servers, which therefore receive your IP address and the usual technical data of a web request (browser type, address of our site). The map engine and the markers are hosted on our own server.
Legal basis: our legitimate interest in showing where each place is (Article 6(1)(f) GDPR).
Photos and fonts
Photos from Wikimedia Commons and press kits are copied to our own server: displaying them sends nothing to Wikimedia or to anyone else. Fonts are hosted on our server too.
Links to other sites
The site links to external websites: official ticket offices, museums, monuments, tourist offices and, on some pages, booking platforms. Once you follow a link, the privacy policy of that site applies. Affiliate links, where they exist, go through the redirect service of our partner Stay22, which records the click and passes an identifier to the platform so that a commission can be attributed to us. Nothing is sent before you click.
The share buttons of articles (Facebook, WhatsApp, X) are plain links: nothing is sent to these networks unless you click one.
Hosting
The site and its data, audience measurement and contact messages included, are hosted in France by o2switch (Clermont-Ferrand). Third-party services process their data under their own policies, sometimes outside the European Union (Stay22, Google, Vimeo). The safeguards that apply are set out in their policies.
Your rights
Under the General Data Protection Regulation (GDPR), you have the right to access, rectify and erase your data, to restrict or object to its processing and to data portability, and you can withdraw your consent at any time. Write to us through the contact page or by post to the address in the legal notice, and we will reply within one month. You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country.
Changes
This policy changes when our practices do. Any significant change is shown on this page with its date.
Privacy policy last updated on 26 October 2026.