In progress New website: details may change. Our new website is still being built. Photographs and tour details may not yet be final, so please contact us or write to contact@pepinparis.com to confirm anything before you book.
This website is operated by Simon Gaulier, entrepreneur individuel, trading as Pépin Paris. Pépin Paris is the data controller responsible for the personal data processed through this website. Full company identification, including our registered address and registration number, is set out in our Legal Notice. For any question relating to your personal data, you can contact us at contact@pepinparis.com. Given the limited scale of our activities, we are not required to appoint a Data Protection Officer, and this address reaches the person responsible for these matters directly.
When you submit a booking request through one of our forms (the contact form, Build your day or a food tour), we collect your name, your email address, and any details you choose to include in your message, such as group size, preferred dates, or the kind of experience you are looking for. Your browser also tells us your time zone (for example, America/Chicago), so that we know what time it is for you when we reply. We do not collect payment information through this website, and we do not ask for sensitive data, such as information about your religion or political views. If you choose to tell us about a mobility need or another health matter, for example through the accessibility box of our contact form, we use it only to adapt your tour.
When you browse this website, standard server logs kept by our hosting provider may record technical information such as your IP address, browser type, and the pages visited. This information is not used to identify individual visitors.
We process your personal data only where the law allows it, on the following bases. To answer your inquiry and arrange the tour you book, the processing is necessary to take steps at your request before entering into a contract, and to perform that contract. To keep the website secure and operational, we rely on our legitimate interest in running and protecting the site. Audience measurement and advertising measurement through Google services rely solely on your consent. Providing the information requested in the contact form is necessary for us to respond, and without it we cannot reply to your inquiry.
We do not sell your personal data, and we do not share it with third parties for their own purposes. To operate this website and provide our service, we rely on a small number of trusted providers who process data strictly on our instructions and only to deliver their service to us. These include OVH, our hosting and email provider, which stores the website, its server logs, and our booking correspondence on servers located in the European Union. Where you have given your consent, we also use Google services (Google Analytics and Google Ads) to measure our audience and the effectiveness of our advertising; these are described in the section on cookies below, and they are not activated unless you accept them. Contact form submissions are received and processed on our own servers and sent directly to our mailbox; they are not handled by any third-party form service.
Each of these providers is bound by a data processing agreement and may only use your data to provide its service to us.
Our hosting and email provider (OVH) operates on servers located in the European Union, so the data it processes for us stays within the European Economic Area. If, and only if, you consent to the Google services described below, certain data may be transferred to Google, which operates in part outside the European Economic Area, including in the United States. Where that is the case, the transfer is covered by the safeguards recognized by the General Data Protection Regulation, in particular the European Commission's Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework. If you do not consent to these services, no such transfer takes place.
We take reasonable technical and organizational measures to protect your personal data. These include encrypted connections (HTTPS), restricted access to your booking correspondence, working only with reputable providers bound by data processing agreements, and collecting only the data we genuinely need to respond to you and manage your tour.
We do not keep your personal data longer than necessary. Booking and inquiry correspondence is kept for the duration of our relationship with you and for 3 years after our last contact, so that we can follow up on your interest and answer any later questions. This period starts again each time you contact us. At the end of it, we may write to you once to ask whether you would like to stay in touch, and if we do not hear back, your data is deleted or anonymised. Information we are required to keep for accounting and tax purposes, such as invoices, is archived separately for the periods set by French law. Server logs are retained only for the short period necessary for security and technical administration.
Under the General Data Protection Regulation, you have the right to access the personal data we hold about you, to have it corrected or deleted, to receive a copy of it, and to restrict or object to certain processing. Where processing is based on your consent, you may withdraw that consent at any time. To exercise any of these rights, contact us at contact@pepinparis.com. We will respond within one month, a period that may be extended for particularly complex requests, in which case we will let you know.
If you believe your data is not being handled properly, you also have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), at www.cnil.fr.
With your consent, we use two Google services. Google Analytics helps us understand which pages interest visitors, and Google Ads helps us measure whether our advertising reaches the right travelers. These services set cookies and may process some data outside the European Economic Area, as explained above. Google Analytics cookies (_ga and _ga_*) expire after 13 months. Both services are switched off by default. When you first visit the site, a banner lets you accept them, decline them, or choose for yourself, and nothing is set before you do. We keep your choice for six months and you can change it at any time using the cookie settings link in the footer of every page. We never use these services to set advertising cookies without your prior agreement.
A few things are also kept in your own browser, never sent to us and never used to follow you: your cookie choice, your choice of currency (euros or US dollars), and, if you start filling in our contact form and leave the page, a draft of what you typed, so that you find it again when you come back. The draft is erased as soon as your request is sent, after seven days, or when you choose “Start over”.
This website may contain links to external sites that we do not operate. We are not responsible for the privacy practices or the content of those sites, and we encourage you to read their own privacy policies.
Our tours and this website are intended for adults. We do not knowingly collect personal data from children under the age of 15 without the consent of a parent or guardian.
We may update this policy from time to time to reflect changes in our practices or in our legal obligations. The date below indicates when it was last revised.
For any question about this privacy policy or about your personal data: contact@pepinparis.com
Last updated: October 2026