Personal data

Our commitments, from sports enthusiasts to sports enthusiasts

Version date: 25/11/2024

YOUR DATA AND DECATHLON: HOW DOES IT WORK?

Your data belongs to you! At DECATHLON, we believe that you should have control over your data. This is the direction we are taking, keeping in mind that we still have some way to go. Apart from the few legal obligations to which we are subject, only you can agree to your data being used by DECATHLON. Although we sometimes rely on subcontractors, they act solely on our behalf and in accordance with our instructions.

We are transparent about all your data! On this page, you can find all the processing activities related to your personal data: where, when, how, and why we process your data, as well as what your rights are.

By logging into your account at account.decathlon.com, you can control your security and manage some of your personal data. We are working to give you control over all of your personal data in this section.

HOW DO WE USE YOUR DATA?

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company (Société par Actions Simplifiée), whose registered office is located at 6 rue des bouvières, 74940 Annecy, France.

For certain processing operations, your personal data may also be processed by other separate data controllers. Where applicable, we indicate this in the relevant processing section.

MANAGEMENT OF YOUR QUOTES & RESERVATIONS

Quote requests on the website

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Your data is also processed by the travel agency operating the trip as a data controller.

Personal data processed:

We process the data required to issue a quote: your personal information (first/last name, email address, contact details, date of birth, etc.), your favorite sport, the desired trip, and any comments left during your request.

Retention periods:

Your data will be deleted 10 years after the last contact.

Legal basis:

In order to properly perform the contract that binds us, we need to process your personal data.

Purposes:

This processing allows us to prepare tailored quotes for your needs so you can book a trip.

Online booking for your trip and sports activities

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Your data is also processed by the travel agency operating the trip as a data controller.

Personal data processed:

We process the data required to book and pay for your trip: your personal information (first/last name, email address, contact details, date of birth, etc.), the booked trip, your payment method, and ID/passport information depending on the booked trip.

Retention periods:

Your data will be deleted 3 years after the last activity.

Legal basis:

In order to properly perform the contract that binds us, we need to process your personal data.

Purposes:

This processing allows us to book your trip and process the payment.

Management and monitoring of trip organization

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Your data is also processed by the travel agency operating the trip as a data controller.

Personal data processed:

We process data that allows us to manage, monitor, and organize your trip: your personal information (first/last name, email address, contact details, date of birth, etc.), postal address, information to prepare your booked trip, and information to prepare your equipment and potential groups during the trip (weight, height, shoe size, skill level, certificates/diplomas, dietary requirements).

Retention periods:

Your data will be deleted 3 years after the last activity.

Legal basis:

In order to properly perform the contract that binds us, we need to process your personal data.

Purposes:

This processing allows Decathlon Travel and/or the partner in charge of the trip to gather and share all necessary planning information with you.

Payment of orders

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process the data required for payment of your trip: your personal information, the payment method used, and the order amount.

Retention periods:

Data related to orders is retained for 10 years. Data related to your credit card is retained for 12 months.

Legal basis:

In order to properly perform the contract that binds us, we need to process your personal data.

Purposes:

This processing allows you to pay for an order and book your trip.

Invoicing

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Your data is also processed by the travel agency operating the trip as a data controller.

Personal data processed:

We process data that enables us to manage the invoicing of your bookings: last name, first name, billing address, email, payment method used, order amount, trip details, and purchase date.

Retention periods:

Invoicing data is deleted after 10 years in accordance with applicable regulations.

Legal basis:

We process your data to invoice you in accordance with our legal obligations.

Purposes:

This processing allows Decathlon Travel to issue and retain invoices for your trip purchases.

Your reviews on our trips and your Decathlon Travel experience

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data that enables us to manage the publication of your reviews, as well as data needed to contact you if necessary: last name, first name, and email.

Retention periods:

Your reviews are anonymized 3 years after the publication date.

Legal basis:

The processing of your personal data is implemented only after obtaining your consent.

Purposes:

This processing allows you to leave online reviews for the Decathlon Travel trips you booked.

OUR ONLINE PAYMENT FRAUD PREVENTION SYSTEM

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data that allows us to protect against online payment fraud: email, customer ID, phone number, billing address, delivery address, payment method details, order amount, and order frequency.

Retention periods:

As part of online payment fraud prevention, your personal data is retained for 3 years.

Legal basis:

The verification prior to your order is based on the legitimate and compelling interest of the data controller (DECATHLON).

Purposes:

This processing prevents non-payment during online transactions. Profiling useful for this purpose is carried out in this context.

Collection of unpaid debts

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

The data processed as part of debt collection includes: last name, first name, billing address, email, payment method used, order amount and sums due, and purchase date.

Retention periods:

Data is retained until the debt is recovered or, failing that, for a duration of 5 years.

Legal basis:

Debt collection is based on the legitimate and compelling interest of the data controller (Decathlon Travel).

Purposes:

This processing allows us to collect unpaid debts.

Customer Service: Modification and cancellation of booked trips

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Your data is also processed by the travel agency operating the trip as a data controller.

Personal data processed:

We process data required to manage modifications, cancellations, and potential refunds: last name, first name, email, travelers, details of the booked trip, modifications to be made, payment method used, and order amount.

Retention periods:

Your data will be deleted 10 years after the last contact.

Legal basis:

In order to properly perform the contract that binds us, we need to process your personal data.

Purposes:

This processing allows Decathlon Travel to manage trip modifications, cancellations, and potential refunds.

Travel insurance

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Your data is also processed by Neat as a data controller.

Personal data processed:

We process data to allow you to subscribe to travel insurance with our partner Neat: last name, first name, date of birth, file number, and trip-related information.

Retention periods:

Your data will be deleted 10 years after the last contact.

Legal basis:

In order to properly perform the contract that binds us, we need to process your personal data.

Purposes:

This processing allows you to subscribe to travel insurance tailored to your trip with our partner Neat.

Your inquiries to our Customer Relations Center

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data necessary to manage your request: last name, first name, email, postal address, voice recordings of phone calls, trip concerned, and your comments. Where strictly necessary and justified by the nature of your request, data relating to your health status may also be processed.

Retention periods:

Your data will be deleted 2 years after the last contact.

Legal basis:

The processing of your personal data is implemented only after obtaining your consent.

Purposes:

This processing allows Decathlon Travel to answer your inquiries made to our customer relations center.

MARKETING, COMMUNICATION, AND ENGAGEMENT WITH OUR TEAMS

Direct Marketing

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data that enables direct marketing management (e.g., newsletter): last name, first name, email, date and place of birth, postal address, cookie-related data, purchase history, practiced sport, and browsing history.

Retention periods:

Your data will be deleted 3 years after the last contact.

Legal basis:

The processing of your personal data is implemented only after obtaining your consent.

Purposes:

This processing aims to send you personalized commercial communications.

Abandoned cart reminder

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data enabling personalized sending: last name, first name, email, and the products in your cart.

Retention periods:

Your data will be deleted 1 year after collection.

Legal basis:

We use your data so you do not lose the trips placed in your cart. Legally speaking, this is known as the legitimate interest of the data controller (Decathlon Travel).

Purposes:

This processing allows sending an email to remind you that a trip is still in your cart.

Personalized advertising display via cookies

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data that enables the personalization of displayed ads: cookie-related data, connection data, location data, purchase history, practiced sport, and browsing history.

Retention periods:

Your data will be deleted 13 months after collection.

Legal basis:

The processing of your personal data is implemented only after obtaining your consent.

Purposes:

This processing allows offering you personalized advertisements and measuring their performance to only send you the most relevant ads.

Exercising your rights

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data related to the exercise of your rights: all your personal data processed by us, particularly in connection with your right of access.

Retention periods:

Your data is retained for 5 years starting from the end of the calendar year of your request.

Legal basis:

Your personal data is collected in accordance with a legal obligation.

Purposes:

This processing enables Decathlon to respond to your requests to exercise your rights regarding your personal data.

SECURITY AND NAVIGATION ON OUR WEBSITE

Authentication with your Decathlon account

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

Data processed includes information required to access your Decathlon account: identification data, connection data.

Retention periods:

Your personal identification data is retained as long as you interact with your account, up to 3 years after inactivity. Connection data is kept for 12 months after collection.

Legal basis:

We use your data to allow you to log in to your account. In legal terms, this is called the legitimate interest of the data controller (DECATHLON).

Purposes:

This processing enables you to authenticate on online interfaces directly using your Decathlon account.

Audience measurement and website visitor statistics

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data related to your browsing on the site, namely your browsing data and user journey on the website.

Retention periods:

Your consent is renewed every 6 months. Data collected during browsing, following consent, is retained for a period of 24 months.

Legal basis:

The processing of your personal data is implemented only after obtaining your consent.

Purposes:

This processing allows Decathlon Travel to measure audience size and produce visitor statistics for its website.

Ensuring website security

Data controller:

The data you entrust to us is processed by Decathlon Experience SAS, a simplified joint-stock company, whose registered office is located at 6 rue des bouvières, 74940 Annecy.

Personal data processed:

We process data related to your connection to the site, namely your connection data.

Retention periods:

Your data is retained for 12 months after collection.

Legal basis:

Website security relies on the legitimate interest of the data controller (Decathlon Travel).

Purposes:

This processing enables Decathlon Travel to ensure the IT security of its website.

RECIPIENTS OF YOUR DATA

We, Decathlon Travel, as data controller for the processing operations listed above, may in certain cases share your data with third parties. We will only share your data with third parties providing sufficient guarantees regarding the implementation of appropriate technical, organizational, and legal measures to guarantee the protection of your rights and data.

These recipients are:

1. Our subsidiaries;
2. Our subcontractors;
3. Our internal teams;
4. Our partner travel agencies;
5. Our partners (e.g., insurance companies);
6. Any administration or judicial authority upon justified requests from them;
7. Any company or organization for fraud protection and credit risk reduction purposes.

MORE INFORMATION ON DATA TRANSFERS

Did you know? Your data may be transferred outside the European Union. Rest assured, these transfers are carried out with the utmost care. Let us explain!

Why do we transfer your data?

The transfer of your data outside the European Union is mainly explained by the location of our subcontractors.

Indeed, to offer you high-quality service, we decided to outsource certain operations to specialized service providers who hold genuine expertise in their fields (An example? Hosting). And some of these providers are established outside the European Union.

How are these data transfers regulated?

Regardless of the countries where our subcontractors are based, we always select them with the utmost vigilance. This is especially true regarding how your data is secured. These subcontractors act only under instructions from DECATHLON and never use your data for anything other than performing the services entrusted to them. A contract is systematically concluded between DECATHLON and the selected subcontractors.

When our service providers are established outside the European Union, we make it a point to select them primarily in countries whose legal framework provides a satisfactory level of security.

The list of these countries is available here: https://www.cnil.fr/fr/la-protection-des-donnees-dans-le-monde

Where this is not possible, we regulate these transfers using appropriate legal mechanisms, notably signing additional contractual clauses specifically designed for this type of transfer.

How do you know if your data is transferred?

If you wish to know whether your data is being transferred, you can refer to the "Transfers outside the EU" section in the description of the relevant processing activity.

YOUR RIGHTS

Entrusting us with your data does not mean you lose control over it—quite the opposite! A brief explanation...

You have several rights. Some apply to all processing of your data, while others depend on the type of processing implemented and, more specifically, the legal basis on which it rests (contract, legal obligation, consent, legitimate interest, etc.).

Below is a brief description of these rights and how to exercise them.

To know precisely which rights attach to your data processing, refer to the "your rights" section in the description of the relevant processing activity.

Right of access:

This right allows you to ask us questions about the nature of data processing concerning you (type of data, origin of collection, etc.). It also allows you to request a copy of all information concerning you. This right applies regardless of the legal basis for processing.

Right to rectification:

Moving home, marriage, a new sport... there are many situations that might lead you to update your data. The right to rectification serves precisely this purpose. This right applies regardless of the legal basis for processing.

Right to object:

This is the right to say "no!", the right not to be included in a data processing activity or to no longer be included. This right applies when processing is based on Decathlon Travel's "legitimate interest," provided this interest is not "compelling."

Right to erasure:

This is the right to be forgotten... and it's completely normal. Decathlon Travel has no reason to keep your data beyond what is necessary. All data concerning you is therefore automatically deleted upon expiration of the retention period announced at the time of collection.

When your data is subject to processing based on your consent or on Decathlon Travel's legitimate (non-compelling) interest, you can obtain early deletion of your data. How? Simply inform us of your wish to withdraw your consent or exercise your right to object.

Don't forget: by logging into your Decathlon account, you can delete it (and its associated data) yourself: Click here.

Right to data portability:

This right allows you to request the data concerning you, provided that it is subject to processing based on your consent or a contractual relationship. What is the difference from the right of access? We are obligated to transmit the data to you in a format technically usable by yourself or by another entity.

Right to restriction of processing:

This right complements some of the other rights set out above. In practice, it allows you to "freeze" your data after a request for rectification, for example. In case of doubt about the legality of one of our processing activities, this right allows you to ask our teams to stop processing your data without deleting it. Finally, if you wish to establish, exercise, or defend your legal rights, you can also use this right to "freeze" your personal data. If you have any questions, feel free to contact us!

EXERCISING YOUR RIGHTS

Send us a message: Click here. To ensure your request is managed as efficiently as possible, please remember to:

1. specify the processing activity/activities concerned by your request;
2. specify the right(s) you wish to exercise;
3. provide any information allowing us to ensure that the requester is indeed the person concerned by the processing (Decathlon card number, last order number, date of birth provided, etc.).

By post: DECATHLON Expérience – Service Client – 6 rue des Bouvières, 74940 Annecy-le-vieux, France. To ensure your request is managed as efficiently as possible, please remember to:

1. specify the processing activity/activities concerned by your request;
2. specify the right(s) you wish to exercise;
3. provide any information allowing us to ensure that the requester is indeed the person concerned by the processing (Last Name, First Name, last order number, date of birth provided, etc.).

If, despite all our efforts, you feel that your rights have not been respected, you have the option to contact the relevant data protection authority (e.g., CNIL in France: https://www.cnil.fr/fr/agir).

INTERACTIONS WITH YOUR SOCIAL NETWORKS

You can create a DECATHLON account using the "Social Login" feature. To use this feature, you must hold an account on a social network (Facebook, Twitter, Instagram, Google, etc.) and authorize that network to share your information. By using Social Login, you expressly authorize DECATHLON to retrieve certain information about you from your social network.

What data does DECATHLON retrieve from my social network via Social Login?

Only data strictly necessary to create your account will be retrieved by DECATHLON (last name, first name, email). DECATHLON will never have access to your chats, preferences, friend lists, etc. Although DECATHLON commits to retrieving no information deemed unnecessary, we advise configuring your social network account to limit shared data to the strict minimum.

What data does DECATHLON send to my social network via Social Login?

We guarantee that DECATHLON will not send any data to your social network concerning your interactions with our brand. However, your social network will necessarily know that you used Social Login to create a DECATHLON account. We assume this information may be used by your social network in accordance with its privacy policy, which we invite you to review carefully before using Social Login.

Who should I contact to delete data shared via Social Login?

Data obtained via Social Login falls under DECATHLON's responsibility and will be processed in accordance with our personal data management policy. Consequently, requests for access, rectification, deletion, etc. must be sent directly to us by clicking here. Please note: any deletion performed at DECATHLON will have no effect on data concerning you processed directly by your social network, and vice versa.

COOKIES AND OTHER TRACKERS

DECATHLON uses cookies and trackers.

To learn more about cookies and trackers, you can visit our dedicated page.

You can modify your preferences and consents regarding cookies and trackers on this page using the "Manage my cookies" button.

OUR DATA PROTECTION OFFICER

The way we process your data doesn't leave you indifferent... and that's completely normal!

By appointing me as Data Protection Officer, DECATHLON entrusted me with the mission of supporting our commercial activity without compromising on respect for your rights and privacy. I do my utmost to fulfill this wonderful mission, with pride and humility.

A question, remark, or concern? I am at your disposal!

To contact me, simply send me a message by clicking right here.

Grégory, Data Protection Officer at Decathlon.