Updated 19 September 2026, this policy explains how TrekHub handles your personal data under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
Data controller
We have not appointed a Data Protection Officer. For any question about your data, use the contact address above.
- Controller
- TREKHUB (SASU)
- Registered office
- 2B place des Orphelins, 67000 Strasbourg, France
- Contact
- contact@trekhub.app
Data we collect
- Account and authentication: email, first and last name, hashed password, language, role, acceptance dates, and data needed to secure the account.
- Profile and matching: optional phone number and country, date of birth, gender, languages, bio, photo, experience, level, pace, and trek or accommodation preferences.
- Use of the service: crews, join requests, memberships, messages, notifications, planning spaces, routes and GPX files, itinerary stages, notes, gear, budgets, indicative bookings, and favourites.
- Communications: support requests, reports, contact messages, and newsletter subscription choices.
- Technical and audience data: IP address, security and server logs, browser, device, language, pages viewed, referrer, and approximate region.
- Cookies and similar technologies described in the Cookie Policy.
Required and optional data
Some data is required to create and run your account: your email, name, and password. Without it, we cannot create your account or provide the service.
Other fields are optional unless a feature says that a criterion is needed, for example to publish a trek intention or request matching. Do not provide them if you do not want to share them with the relevant people.
Why we use your data, and the legal basis
- Provide your account and the service
- Performance of the contract
- Match you with compatible trekkers and crews
- Performance of the contract
- Transactional emails (verification, password reset)
- Performance of the contract
- Newsletter and occasional dispatches
- Your consent (opt-in)
- Support, security, moderation, prevention of fraud and abuse
- Our legitimate interest
- Audience measurement and service improvement
- Our legitimate interest, subject to the rules applicable to tracking technologies
- Comply with legal obligations
- Legal obligation
Who can access your data
- The TrekHub team, on a need-to-know basis.
- Other members, according to the visibility of your profile, crew, and shared content; the public when you make a crew public.
- OVH SAS for application, database, and object-storage hosting within the European Union.
- BunnyWay d.o.o. for caching and worldwide delivery of public editorial media.
- Scaleway S.A.S. for transactional email delivery from its European infrastructure.
- Mapbox for displaying maps and routes.
- Authorities or professional advisers where required by law or necessary to defend our rights.
Location and transfers
Account and profile data and private content are hosted by OVH within the European Union. Scaleway Transactional Email processes emails in Europe: message bodies and attachments are transmitted and automatically deleted after processing; sending metadata and technical logs follow the provider's applicable operational and contractual retention periods.
Bunny may process worldwide the IP address and technical headers needed to deliver public editorial media. Mapbox may process in the United States and other countries the requests needed to provide maps, including IP address, device information, and data contained in the request. These transfers are covered by applicable contractual safeguards, including standard contractual clauses where required.
How long we keep your data
- Account and profile data
- While your account is active, then deleted or anonymised after closure
- Content you created
- Private content is deleted with the relevant space or account; content already shared may remain anonymised for the life of the crew or thread to preserve its history
- Technical logs
- Up to 12 months
- Proof of consent
- Up to the period required by law
- Provider metadata and logs
- According to their applicable operational and contractual retention periods
Your rights
Under the GDPR, you have the right to:
- access your data and obtain a copy;
- rectify inaccurate or incomplete data;
- erase your data (right to be forgotten);
- restrict or object to certain processing;
- data portability;
- withdraw your consent at any time, without affecting prior processing.
How to exercise your rights
Write to us at the contact address below. We normally respond within one month; this may be extended by two months for a complex or numerous request, in which case we will tell you. We may request only the information needed to verify your identity. If you believe your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL).
Shared data and account deletion
When you delete your account, your account and profile data are deleted. Contributions already shared in a crew—including messages, budgets, and notes—may remain visible to preserve the shared history, with the author replaced by “Deleted account”. Some data may also remain temporarily in backups or where required by law, security needs, or a dispute.
Automated processing and matching
Our matching feature uses an algorithm based on the criteria you provide (dates, level, style, location) to suggest compatible trekkers and crews. These are suggestions only. They do not produce any automated decision with legal or similarly significant effect; you always choose who to contact or join.
Security
We apply reasonable technical and organisational measures: encrypted connections (HTTPS), hashed passwords, token-based authentication, and restricted access to data.
Cookies
The cookies we use are described in our Cookie Policy.
Changes to this policy
We may update this policy. Its update date appears in the introduction, and significant changes will be notified through the platform or by email.