Privacy Policy
1. GENERAL INFORMATION
The company PUY DU FOU FRANCE, a simplified joint-stock company, whose registered office is located at lieu dit Puy du Fou, 85590 LES EPESSES, registered in the Trade and Companies Register of LA ROCHE-SUR-YON under number 347 490 070, represented by Mr Olivier Strebelle in his capacity as Chief Executive Officer, as well as L'ASSOCIATION POUR LA MISE EN VALEUR DU CHÂTEAU ET DU PAYS DU PUY DU FOU, an association governed by the Law of 1901, whose registered office is located at Puy du Fou - CS 70025 – 85590 LES EPESSES, SIREN 312 772 981, represented by Mr Nicolas de Villiers in his capacity as President, (hereinafter collectively referred to as " Puy du Fou " or individually as "Puy du Fou France" or "l'Association du Puy du Fou") have created this Personal Data Protection Policy in order to communicate Puy du Fou's policy and practices regarding the collection and disclosure of information about you obtained on the puydufou.com website, its telephone customer service centre or any other physical reception point in the park.
For internal operational reasons, certain processing operations relating to you are carried out by Puy du Fou France and l'Association du Puy du Fou as joint data controllers. Others are carried out solely by one of the two entities as a separate data controller.
Processing operations carried out jointly by Puy du Fou are governed by a joint controller agreement. This agreement reflects the respective roles and relationships of the joint controllers with regard to the data subjects.
The main points of the agreement will also be made available to data subjects upon simple request.
Puy du Fou attaches great importance to the respect of your privacy and complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
2. PURPOSES AND LEGAL BASES FOR COLLECTING YOUR DATA
Your personal data are collected on the basis of your explicit consent, legitimate interest, or because they are necessary for the performance of a contract.
Your personal data are therefore collected in order to:
• Respond to your questions submitted via the "contact us" form or through our telephone service;
• Send you our brochures following your request via the "Brochure" form or through our telephone service;
• Manage your purchases and reservations;
• Ensure the security of online transactions, prevent fraud and payment incidents;
• Survey you regarding your satisfaction with our services;
• Carry out loyalty-building activities and personalised commercial prospecting;
• Contact you in the event of an abandoned basket to allow you to complete your order at a later time;
• Send you information about offers, news and events from Puy du Fou and other companies in the Puy du Fou group1;
• Where applicable, manage within the park the safety of property and persons, emergency assistance to persons within the framework of the medium-scale emergency response plan, lost persons, lost property and record visits to our medical centre.
The Personal Data required to fulfil the purposes described above are indicated on our online forms or by our telephone operators or any reception staff in the Park. If you do not provide this data, Puy du Fou will be unable to respond to your requests.
1 Puy du Fou Signature, Le Grand Tour, Puy du Fou Editions, Puy du Fou Films, Puy du Fou Nederlands, Puy du Fou España, Puy du Fou UK
3. RECIPIENTS OF YOUR PERSONAL DATA
Your Personal Data are accessible only to those persons who need to be aware of them in the context of processing operations. Access by authorised persons is limited to their responsibilities and the performance of their duties or functions, and they are subject to a confidentiality obligation.
In particular, the categories of recipients of personal data processed by Puy du Fou are:
Internally:
• The Commerce & Reservations Department;
• The Marketing and Digital Department;
• The Operations Department;
• The Information Systems Department;
• The Administrative and Financial Department;
• L'Association pour la mise en valeur du château et du pays du Puy du Fou.
Externally:
• Possible subcontractors of Puy du Fou for exclusively technical and logistical reasons (carriers, routers, security, hosting, catering and site maintenance service providers, payment and fraud management providers, insurers, etc.);
• Insurance company (in the event of subscription to cancellation insurance).
Finally, Puy du Fou may be required to disclose your Personal Data to third parties when such disclosure is required by law, a regulatory provision or a court order, or if such disclosure is necessary to ensure the protection and defence of its rights.
4. TRANSFERS OF PERSONAL DATA OUTSIDE THE EU AND EEA
Puy du Fou does not use service providers located outside the European Union and the European Economic Area (EEA: EU Member States, Iceland, Liechtenstein and Norway).
In the event that Puy du Fou were to use service providers located outside the European Union and the European Economic Area (EEA: EU Member States, Iceland, Liechtenstein and Norway), it would ensure that data transfers outside the EEA take place lawfully, by using the transfer tools provided for under data protection provisions and by putting in place appropriate safeguards and protective measures. To this end, either the service providers are located in a country whose level of protection has been deemed adequate by the European Commission, or standard contractual clauses approved by the European Commission have been signed with these recipients. In the latter case, Puy du Fou undertakes, with the assistance of the service provider concerned, to assess the level of protection offered by the local legislation and to take into account the practices of authorities in the third country by carrying out a data transfer impact assessment ("DTIA").
Puy du Fou undertakes to provide, upon request by data subjects, a copy of the safeguards applied or to indicate where they have been made available.
5. RETENTION PERIODS
Puy du Fou undertakes to use Personal Data only for the period necessary to fulfil the purposes described above.
• Data relating to your reservations will in principle be retained by Puy du Fou for a period not exceeding the applicable statutory limitation periods.
• Data processed in the context of after-sales service are retained for a period not exceeding 1 year.
• Data from video surveillance are retained for a period not exceeding 1 month from their collection.
• Your banking data will be retained securely for the validation of your order and payment. They will then be retained for a maximum of 13 months (15 months in the case of payment by deferred debit card).
• Your data used, with your consent, for commercial prospecting purposes will be retained for a period of three years, from the date of your visit if you have made a reservation at Puy du Fou, or from the date of their collection or your last contact if you have never made a reservation at Puy du Fou. The following are considered as contact: a request for documentation, a call to our Visitor Relations Service or a click on a hyperlink contained in an email; however, the opening of an email cannot be considered as a contact. At the end of this three-year period, Puy du Fou may contact you again to find out whether or not you wish to continue receiving commercial communications.
• Your data recorded in the case of a lost person are destroyed 1 month after the capture of the video images.
• Your data recorded in the case of a lost item are retained for a period of 3 years from the date of the loss or theft.
• Your data relating to a found item are retained for 3 years from the date of the claim for the item.
• Your data recorded in the case of a visit to the medical centre are retained for up to 20 years.
Once your personal data are no longer necessary for the purposes set out above or for archiving purposes, Puy du Fou will ensure that they are completely destroyed or anonymised.
6. SECURITY
Puy du Fou has implemented appropriate technical and organisational measures to ensure the confidentiality, integrity and security of your Personal Data.
Puy du Fou's computer systems are subject to physical and software protection in line with the state of the art. Physical and electronic backup procedures for the data collected are implemented in accordance with current French legislation on personal data protection and market standards. Puy du Fou employees who, by virtue of their role, have access to your Personal Data are subject to strict confidentiality obligations. They also receive training in personal data protection.
Please be aware, however, that no data transmission over the Internet is 100% secure and that all information communicated online can potentially be intercepted and used by persons other than the intended recipient.
7. AUTOMATED DECISION-MAKING
Puy du Fou does not carry out any automated decision-making.
8. YOUR RIGHTS REGARDING THE DATA COLLECTED
In accordance with applicable regulations, you have the following rights regarding your personal data:
Right of access: This is the right (I) to obtain confirmation as to whether or not personal data are being processed; and where they are, to (II) receive a copy of those personal data.
Right to rectification: This is the right to obtain the rectification of personal data that are inaccurate or incomplete.
Right to object: This is the right to object, on legitimate grounds, to the processing of one's personal data, except where such processing is carried out exclusively within the framework of the data controller's public interest tasks. The processing concerned must cease unless there are compelling legitimate grounds requiring Puy du Fou to continue processing the personal data, or where they are necessary for the establishment, exercise or defence of legal claims, or where the processing is carried out for scientific, historical or statistical purposes in the public interest.
This is also the right to object at any time and without condition to one's personal data being used to send marketing communications (e.g. information about Puy du Fou activities/services; invitations to events; newsletters; …).
You have the option at any time to unsubscribe from emails. To do so, you can contact us by email at mesdonnees@puydufou.com or by clicking on the unsubscribe link included in each email. This applies to all electronic communications from Puy du Fou, with the exception of emails necessary for processing the reservation and sending travel documents.
Right to erasure: This is the right to request the erasure of personal data when they are no longer necessary in relation to the purpose for which they were collected, if they have been processed unlawfully, in order to comply with a legal obligation under Union or French law to which Puy du Fou is subject, to withdraw your consent, or where you have objected to the processing and there are no overriding legitimate grounds for the processing, or where the data are processed for prospecting purposes.
Right to restriction: This is the right to obtain from Puy du Fou the restriction of processing, in particular where you contest the accuracy of your personal data for a period enabling Puy du Fou to verify the accuracy of the data; where the processing is unlawful and you oppose erasure and request restriction of use instead; where Puy du Fou no longer needs your personal data for the purposes of processing but they are still required by you for the establishment, exercise or defence of legal claims; where you have objected to processing pending verification as to whether the legitimate grounds pursued by Puy du Fou override your own.
Right to data portability: This is the right to receive the personal data concerning you that you have provided to Puy du Fou, in a structured, commonly used and machine-readable format. You have the right to transmit those data to another data controller under the conditions set out in Article 20 of the GDPR.
Right not to be subject to a decision based solely on automated processing: This is the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Exceptions to this right exist (for example, where the decision is necessary for the conclusion or performance of a contract between you and Puy du Fou, or where the decision is authorised by Union or French law to which Puy du Fou is subject and which also provides for appropriate measures to safeguard your rights, freedoms and legitimate interests, or finally where the decision is based on your explicit consent).
Right to define directives regarding the fate of your personal data after your death: This is the right to define directives relating to the retention, erasure and communication of your personal data after your death. These directives may be general or specific.
These rights may be exercised directly with Puy du Fou by email at mesdonnees@puydufou.com or by post to Puy du Fou – Gestion des données personnelles – Direction des Ressources Humaines - CS 70025 - 85590 Les Epesses. Proof of identity may be requested in the event of reasonable doubt as to the identity of the applicant.
In addition, you have the right to lodge a complaint with the supervisory authority, namely the CNIL for France, if you consider that the rights conferred by the GDPR have been infringed or have reason to believe that these rights have been infringed.
March 2026