Privacy and cookies
Travel by Air Corsica is Air Corsica's travel magazine dedicated to Corsica. This page explains what personal data is processed when you visit the website, why, for how long, and how to exercise your rights. The website offers no user accounts, does not sell any data and carries out no advertising profiling.
1. Data controller
The data controller is Air Corsica [company name, address, Data Protection Officer (DPO) contact: TO BE COMPLETED BY AIR CORSICA].
The website is hosted and developed by our agency, on servers located [location: TO BE SPECIFIED].
2. Data collected and purposes
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form | Name, email, telephone (optional), subject, message, page of origin, language | Legitimate interest in replying to your enquiry | [Proposal: 3 years after the last exchange — TO BE APPROVED] |
| Limiting the number of submissions (anti-abuse) | Non-reversible fingerprint of the IP address | Legitimate interest (website security) | [TO BE APPROVED] |
| Form security | Session cookie (anti-forgery token) | Legitimate interest (security) — strictly necessary cookie | Length of the session |
| Remembering your cookie choices | “tbac_consent” cookie | Legal obligation to obtain and record your choice — strictly necessary cookie | 6 months |
| Audience measurement | Google Analytics identifiers, browsing data | Consent | Cookies up to 13 months |
| Anti-spam protection (contact page) | Technical data processed by Google reCAPTCHA v3 | Consent | According to Google's terms |
| Suggesting flights from the nearest airport | IP address (approximate geolocation) | Consent | Not stored by the website [TO BE CONFIRMED] |
| Counting clicks on banners | No personal data (aggregated daily count) | Not applicable | Not applicable |
Contact form submissions are sent by email to the editorial team and archived in the website's administration tool.
3. Cookies and storage
| Name | Purpose | Duration | Category |
|---|---|---|---|
| tbac_consent | Remembering your consent choices | 6 months | Necessary |
| PHP session cookie | Form security (anti-forgery token) | Length of the session | Necessary |
| _ga, _ga_* | Audience measurement (Google Analytics 4) | Up to 13 months | Audience measurement (after consent) |
No cookie or service requiring consent is set or loaded before you have made a choice. Only strictly necessary cookies are used without your agreement.
4. Third-party services
Audience measurement
Once you have given your consent, the website uses Google Analytics 4, loaded via Google Tag Manager, with Google Consent Mode v2 set to “denied” by default. Provider: Google Ireland Limited / Google LLC.
Third-party / functional services
- Google reCAPTCHA v3, on the contact page only, to combat spam. Without your consent, the form is still protected by a honeypot field and a minimum delay before submission.
- Approximate geolocation by IP address, via the freeipapi.com service, used by Air Corsica's flight widget to suggest flights departing from the nearest airport. This feature is technically blocked without your consent.
Air Corsica flight widget
Air Corsica's “Travelink” flight search widget (explore.aircorsica.com) is only loaded when you scroll down to it. It loads fonts from Google Fonts: your IP address is then transmitted to Google. [Point currently under review with Air Corsica.]
Advertising banners
Clicks on banners are counted in aggregate, per day, without any personal data. Banners link to the advertiser's website (often Air Corsica), which applies its own privacy policy.
5. Recipients and transfers outside the European Union
- Air Corsica's editorial team and our agency (website hosting and maintenance), for contact form messages.
- SendGrid (Twilio, United States), for delivering contact form emails; transfers governed by the European Commission's standard contractual clauses.
- Google Ireland Limited / Google LLC (Google Analytics, Google Tag Manager, reCAPTCHA, Google Fonts); transfers to the United States governed by the EU–US Data Privacy Framework and standard contractual clauses.
- freeipapi.com, for approximate geolocation (after consent).
6. Retention periods
- Contact form messages: [proposal: 3 years after the last exchange — TO BE APPROVED].
- “tbac_consent” cookie: 6 months.
- Session cookie: length of the session.
- Google Analytics cookies: up to 13 months.
7. Your rights
Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your data. Where processing is based on your consent, you may withdraw it at any time.
To exercise these rights, please contact Air Corsica [address / DPO contact: TO BE COMPLETED BY AIR CORSICA]. You may also use the contact page.
If you believe your rights have not been respected, you may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
8. Managing your consent
On your first visit, a banner offers you three options: Accept, Decline or Customise (by category: audience measurement; third-party services). Nothing is set or loaded before you make your choice, apart from strictly necessary elements.
You can change your choice at any time using the “Manage cookies” link in the footer. If you withdraw your consent, the page is reloaded without the services concerned.
9. Updates
This policy may be amended to reflect changes to the website or to the regulations. Last updated: October 2026.