Privacy and Cookie Policy
Last updated: 1 October 2026
This policy explains how Valor Tour LLC ("we", "us") processes personal data when you visit louvre-tickets.paris (the "Website"), book a Product or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR where applicable, and other applicable data protection laws.
1. Controller and contact
| Controller | Valor Tour LLC, a Delaware limited liability company (State File No. 105315000) |
| Address | 8 The Green, Ste B, Dover, Kent County, DE 19901, United States (registered agent) |
| Privacy contact | hello@louvre-tickets.paris |
| EU representative (Art. 27 GDPR) | [name and address of EU representative] |
2. What data we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email, phone number (optional), visit date and time, number and category of visitors, booking reference | Processing your booking, issuing and sending tickets, informing you of changes, customer service | Performance of a contract (Art. 6(1)(b)) |
| Payment status and transaction details (we do not store full card data) | Taking payment, preventing fraud, handling refunds and chargebacks | Contract (Art. 6(1)(b)); legitimate interest in fraud prevention (Art. 6(1)(f)) |
| Invoices and booking records | Accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Name, email and message content from the contact form or emails | Answering your questions, complaints and group or agency requests | Contract or pre-contractual steps (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| IP address, browser type, pages requested, date and time (server logs) | Delivering the Website, security, troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Cookie and similar data for analytics or advertising (only if enabled) | Measuring visits and the performance of our advertising | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
Providing booking data is necessary to conclude the contract; without it we cannot process your booking. We do not use automated decision-making or profiling that produces legal effects for you.
3. Who we share data with
We only share personal data where necessary for the purposes above:
- Venues and tour partners (for example museums, guides and cruise operators) to issue tickets and provide the booked services. Some Venues require visitor names.
- Payment provider: Stripe, to process payments.
- Email service provider: [email provider name], to send confirmations and tickets.
- Hosting and database: Vercel Inc. (USA), which hosts the Website, and Neon (database hosting in the EU, Frankfurt), which stores booking data.
- Map tiles: when the map on the Website is displayed, your browser loads map images from the OpenStreetMap Foundation's servers, which receive your IP address.
- Google Analytics and Google Ads (Google Ireland Ltd. and Google LLC), to measure visits, bookings and the results of our advertising, only if you have given consent.
- Professional advisers and authorities where required by law or to establish, exercise or defend legal claims.
We never sell your personal data.
4. International transfers
Valor Tour LLC is based in the United States, and some of our service providers are located outside the European Economic Area. Where personal data is transferred outside the EEA or the UK, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified recipients) or on the European Commission's Standard Contractual Clauses, together with appropriate additional safeguards. Transfers that are necessary to perform your booking may also be based on Article 49(1)(b) GDPR.
5. How long we keep data
- Booking and customer service data: for the duration of the booking and up to 3 years after your visit, to handle complaints and legal claims.
- Invoices and accounting records: for the period required by tax and accounting law (generally up to 10 years).
- Contact requests that do not lead to a booking: up to 12 months.
- Server logs: generally no longer than 30 days, unless needed to investigate a security incident.
6. Cookies and similar technologies
We use only what is necessary for the Website to work, unless you agree to more. When you first visit, our banner lets you choose "Essential only" or "Accept all".
| Name | Type | Purpose | Duration |
|---|---|---|---|
| cookie-consent | Local storage, strictly necessary | Remembers your cookie choice so we do not ask again | Until you clear your browser data |
| Google Analytics (_ga, _ga_*) and Google Ads (_gcl_au and similar) | Optional, consent required | Measuring visits, bookings and the performance of our advertising (Google Ads conversion tracking) | Up to 13 months |
Fonts are served from our own servers; no data is sent to Google Fonts. You can change your cookie choice at any time by clearing the Website's data in your browser, after which the banner will appear again. You can also block cookies in your browser settings.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict processing in certain circumstances;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
To exercise your rights, email hello@louvre-tickets.paris. We may ask you to verify your identity and will reply within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work (in France, the CNIL).
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted (HTTPS) connections and restricted access to booking data. No method of transmission over the internet is completely secure, but we work to protect your data and will notify you and the authorities of a data breach where required by law.
9. Children
Bookings must be made by adults. We only process children's data (for example age category or name, where a Venue requires it) as provided by the adult making the booking.
10. Changes to this policy
We may update this policy to reflect changes in our services or the law. The current version is always available on this page, with the date of the last update shown at the top.
See also our Terms and Conditions and Legal Notice.