Onatea privacy policy

Last updated: 9 July 2026 - Version: 1.0

This policy explains what personal data is processed when you book an activity through the Onatea online booking service (book.onatea.app): catalogue, activity page, booking form and the page for tracking your request.

It does not cover the internal tools used by the professional to run their business (messaging, scheduling), which are covered by a separate policy.

Your data is processed in compliance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978 ("Informatique et Libertés").

1. Who processes your data

Two parties are involved when you book.

The provider with whom you book the activity. Your booking is concluded with them. They are the data controller for the data in your booking request.
Onatea, the publisher of the booking tool, which provides the technical platform. Onatea processes your booking data - including sending the confirmation email - on the provider's behalf, and acts on its own behalf only for abuse prevention and anonymous audience measurement.

Platform publisher:

Publisher: Onatea, a SAS with share capital of €1,000
Registered office: 138 avenue Victor Hugo, 75016 Paris, France
Registration: SIREN 106 095 078
Data protection contact: privacy@onatea.com

Allocation of roles: the provider is the controller for the booking data; Onatea acts as a processor for that data, including sending the confirmation email, and as a controller only for the processing it decides on its own (abuse prevention, audience measurement). Section 7 explains who to contact for each case.

2. Data we process

2.1 Data you enter when booking

Required:

First and last name;
Email address (it receives your confirmation and the link to track your request).

Optional:

Phone number;
Message or special requests (free text). This field is not intended for detailed medical information (see §2.4);
Transfer request and pickup location, where applicable.

Booking data: chosen activity, date and time slot, number of adults and children.

Language: the language in which you view the service at the time of booking is kept with your record so that later emails (confirmation, validation, reminders) can be sent to you in that language.

The identity and contact details of the provider with whom you book (the main controller) appear on the booking page.

If you have already booked with the same provider using the same email address, your existing record is reused (no duplicate is created).

2.2 Data collected automatically

IP address: used to prevent abuse (rate limiting) and sent to Cloudflare for anti-bot verification (Turnstile). It is only kept temporarily in our technical caches and, if thresholds are exceeded, in our logs.
Timestamp of acceptance of the terms: proof of your consent at the time of booking.
Your email is hashed (irreversibly transformed) in our technical anti-abuse mechanisms, and never appears there in clear text.
Infrastructure logs (Cloudflare, hosting) may record connection data for security and proper operation.

2.3 What we do not collect

No payment data. Online booking is a request (request-to-book): no payment, no bank card, no card token is collected through the service. Any deposit is requested later by the provider, outside the platform.
No account or password: booking does not require creating an account.
No date of birth, postal address or nationality.
Your booking data is not processed by artificial intelligence. (If you then reply to the confirmation email, your message reaches the provider's mailbox, governed by the privacy policy of their professional workspace.)

2.4 Health data

Some activities, in particular diving and water sports, may lead you to mention a health condition (special-category data within the meaning of Article 9 of the GDPR). If you enter such information in the special-requests field, it is processed on the provider's behalf, who is responsible for it and for obtaining your explicit consent.

This field is not intended for medical detail: for any question about fitness or a health condition, contact the provider directly, who will tell you how to proceed.

3. Purposes and legal bases

Processing your booking request and passing it to the provider: performance of the pre-contractual / contractual relationship between you and the provider (Onatea acts as a processor on its instructions).
Sending you the confirmation email and the tracking link: same basis (processing on the provider's behalf).
Preventing fraud and abuse (rate limiting, anti-bot): Onatea's legitimate interest (controller for this processing).
Anonymous audience measurement: Onatea's legitimate interest (controller for this processing).
Keeping proof of your acceptance of the terms: legal obligation / legitimate interest.

Onatea does not make any solely automated decision concerning you within the meaning of Article 22 of the GDPR.

4. Recipients and processors

Provider - main recipient: receives your request and contact details, manages the booking (region: depending on the provider).
Google Cloud - hosting of the API, database and activity photos (EU, europe-west1).
Cloudflare - hosting/CDN of the service, anti-bot (Turnstile), web application firewall; sees the IP and traffic in transit (global edge).
Brevo - sending the confirmation email (email, first name, summary) (EU, France).
PostHog - anonymous audience measurement (EU).
Google Maps Platform - displaying the meeting-point map, only if the provider has configured it (US).

No payment processor is involved in this service (see §2.3).

We neither sell nor rent your data to third parties. Apart from the recipients above, it is only disclosed at the request of the competent authorities or in the context of litigation. In the event of a merger, acquisition or asset transfer, it could be transferred to the entity concerned, which would be required to process it in accordance with this policy.

5. Cookies and trackers

The service sets only one functional language-preference cookie (onatea_widget_locale, lasting 1 year), which remembers the language you chose and has no tracking purpose: it is exempt from consent.
Audience measurement (PostHog) works in memory only: the anonymous identifier disappears when the tab is closed, with no persistent profile, no session recording and no identifying personal data.
Cloudflare Turnstile (anti-bot protection) may set its own technical cookies for security purposes - a strictly necessary measure.
Google Maps (meeting-point map) is a third-party Google service that may set cookies which are not strictly necessary. The map is therefore only loaded after an action on your part (clicking "Show the map"): no Google cookie is set until you enable it.
Fonts are self-hosted (no call to a third-party service).

Apart from Google Maps, this scope (language cookie, in-memory PostHog, Turnstile) consists of functional or strictly necessary cookies and does not require a consent banner.

6. Retention periods

Booking tracking link: the link received by email expires 60 days after the activity date. Your booking data then remains in the provider's database, but access via this link is cut off.
Customer record and booking: kept by the provider for the duration of your relationship with them, then archived for up to 5 years after your last activity (commercial limitation period).
Anti-abuse counters (IP, hashed email): temporary (a few hours at most).

7. Your rights and contacts

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, and you may set post-mortem directives.

For your booking data (for which the provider is the controller, including the confirmation email): send your request to the provider with whom you booked. Onatea assists them as a processor.
For processing for which Onatea is the controller (abuse prevention, audience measurement): contact privacy@onatea.com.
Where processing relies on your consent (in particular the processing of any health data you may have provided), you can withdraw it at any time; this withdrawal is exercised with the provider, the controller for that processing.
Cancelling a booking is not automated: it goes through the provider.
We endeavour to respond to any request within one month.
Complaint: you may refer the matter to the CNIL, the French data protection authority (www.cnil.fr).

8. Transfers outside the European Union

The core of the service is hosted in the European Union (Google Cloud europe-west1, Brevo in France, PostHog in the EU). Some processing may involve a transfer outside the EU, in particular to the United States:

Google Maps (map display, if configured);
Cloudflare (global delivery network, without strict EU residency by default).

These transfers are governed by standard contractual clauses (SCCs) and/or the Data Privacy Framework (DPF).

9. Security

HTTPS across the entire service; hardened security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).
Tracking link = signed token with a limited lifetime, masked in audience measurement.
Anti-abuse: Turnstile anti-bot, rate limiting, email hashed in caches.
Strict separation between providers: each piece of data is attached to a specific provider.

In the event of a data breach likely to present a risk to your rights, Onatea informs the provider concerned (the controller) without delay and assists them in notifying the supervisory authority and, where the regulation requires it, the data subjects.

10. Minors

The booking service is intended for adults booking for themselves or their group. The form records a number of child participants, but no personal data about them is collected at this stage.

11. Changes

We may update this policy. Substantial changes applicable to future bookings will be flagged on the service, where possible at least 30 days before they take effect. The last-updated date appears at the top of the document.

The booking service is offered in several languages (French, English, Spanish, Italian, German, Portuguese). This policy is available at least in French and English; in the event of a discrepancy between language versions, the French version prevails.