Privacy notice — bot-events.com

The data controller is the Best of Tours entity that sells the event you book:

• Best of Tours SAS — 26 bis rue de la Calade, 84200 Carpentras, France (France-based events, e.g. COP31).
• Best of Tours Ltd — 4/4a Bloomsbury Square, WC1A 2RP London, United Kingdom (UK events, e.g. Birmingham 2026).

The relevant entity is identified on each event's booking terms.

Privacy contact: contact@bestoftours.co.uk

• Booking details — first/last name, email, phone, organization, check-in/out dates, room count, special requests. Used to provision and confirm your hotel reservation.
• Payment data — handled directly by Stripe (we never see or store your card number). We receive a payment identifier and confirmation status only.
• Technical data — IP address, browser user-agent, minimal request logs (kept by our hosting provider for security and incident response).

• Contract performance (art. 6(1)(b)) — booking details and payment data are processed to perform the booking contract you enter into.
• Legal obligation (art. 6(1)(c)) — financial records retained per French accounting and tax obligations.
• Legitimate interest (art. 6(1)(f)) — technical logs for security and abuse prevention.

• The contracted hotel for your stay — your name, dates, room type, and any relevant special requests are shared for check-in operations.
• Stripe (Stripe Payments Europe Ltd, Ireland) — payment processing.
• Brevo (Brevo SAS, France) — transactional email delivery (booking confirmation, balance reminder).
• Google Cloud (Google Ireland Ltd, Dublin) — hosting infrastructure (Cloud Run, Firestore) in EU regions.
• Google Analytics (Google Ireland Ltd) — traffic measurement, with IP anonymization. Only active after you accept analytics cookies.
• Meta (Meta Platforms Ireland Ltd) — advertising measurement via the Meta pixel. Only active after you accept cookies; no data is sent to Meta if you decline.
• LinkedIn (LinkedIn Ireland Unlimited Company) — advertising measurement via the LinkedIn Insight Tag. The tag is loaded only after you accept cookies; nothing is sent to LinkedIn if you decline.

• Active booking records: until 12 months after the event ends.
• Accounting/invoicing records: 10 years (French Code de commerce art. L123-22).
• Technical logs: 12 months maximum.

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with the French supervisory authority (CNIL, cnil.fr).

To exercise any of these rights, email contact@bestoftours.co.uk with the booking reference and a description of your request. We respond within 30 days.

Our core processors (Brevo, Stripe, Google Cloud) operate within the EU. Some analytics processors (Google, Meta, LinkedIn) may transfer data to the United States; these transfers rely on the EU-US Data Privacy Framework where applicable, and on Standard Contractual Clauses approved by the European Commission otherwise.

• Essential storage — technical session state required to operate the booking flow and admin console. Exempt from consent under PECR / ePrivacy.
• Analytics (Google Analytics 4) — measures traffic with IP anonymization. Loaded with consent denied by default (Google Consent Mode v2); only enabled if you accept.
• Advertising (Meta pixel) — measures campaign performance. The pixel is loaded with consent revoked; it sends nothing to Meta unless you accept.
• Advertising (LinkedIn Insight Tag) — measures campaign performance. The tag is not loaded at all until you accept; nothing is sent to LinkedIn if you decline.

Analytics and advertising are processed on the basis of your consent (GDPR art. 6(1)(a)), which you give or refuse via the cookie banner and can withdraw at any time by clearing the bot-events-consent entry in your browser storage.