Last updated : March 27 2025
Protecting our customers' personal data is one of our core concerns.
This document applies to data that we collect online, on our websites and mobile applications, but also to data that we collect offline in our parks, shops or at events.
It is our wish to provide you with all necessary information for a good understanding of how your data are used:
Wanneer u boekt en/of toegang krijgt tot onze diensten, worden uw persoonsgegevens verwerkt door :
And,
In this policy the word "we", refers to these companies, which may act together as joint controllers for the processing operations indicated below.
While Compagnie des Alpes is in charge of the management and supervision of the IT system used to collect and process your data, it is nevertheless solely up to the Group Walibi Holland, as an autonomous data controller, to manage the contractual relationship with you, to provide you with the ordered services, and to carry out marketing and advertising operations on its services and brands.
Compagnie des Alpes Group and Walibi Holland Groupe : internal recipients:
Your data are processed jointly by Walibi Holland Groupe and Compagnie des Alpes, the parent company of the Compagnie des Alpes Group.
Within these two companies, your data are only accessible to a limited number of people, within specific departments (customer service, sales, accounting, IT, etc.), only if access to the data is necessary for the needs of their functions.
However, your data will not be shared with other companies of the Compagnie des Alpes Group unless you have given your explicit consent or if you are a business customer (e.g. tour operator, distributor, B2B customers).
For our business customers, unless you object to this processing, your data may be shared with other companies in the Compagnie des Alpes group that operate leisure parks, so that you can receive our offers for any products that may interest you. The list of companies involved is the following:
Compagnie des Alpes Group external recipients:
Your data may also be shared with recipients outside of the Compagnie des Alpes Group:
We may collect your personal data on different occasions:
Online :
On our website or mobile application, receive our newsletters, log in to your account, place orders or use digital services. Specific to the mobile application : to optimise your park experience by providing you with real-time updates on queues and crowds in the park, helping with park navigation and giving you tips & tricks on certain parts of the park
Within our leisure parks:
While enjoying our facilities, alone or with friends and family: photography, disabled access, access to discounted rates, public wifi, equipment rental, video surveillance, overnight stays in Walibi Village.
During our interactions with you:
When you open or reply to a newsletter, take part in a satisfaction survey or participate in a contest. When you call customer services or interact via social networks with a complaint or a request.
Via our Partners:
When you access our services through an intermediary (e.g. travel agencies, partner distributors).
We only collect the data that are strictly necessary for their use, and no more!
Depending on your visit to our park or websites, we may collect the following information:
At the end of the retention periods defined below, we delete your data from our systems or make it anonymous so that it can no longer be used to identify you.
Processing Operations
| Legal Basis | Data retention periods |
Customer Account | Fulfilment of the contract | For as long as your customer account is active, and up to 2 years after the last connection to your account. |
Order processing | Fulfilment of the contract | For 5 years from the date of purchase For online orders : The data linked to your bank card are retained for 13 months by our payment service providers after the last debit date for proof purposes in the event that the transaction is disputed (15 months in the case of deferred debit payment cards). The cryptogram is not retained after the transaction. |
Order processing of your reservation at Walibi Village | Legal Obligation | For 7 years from the date of purchase For online orders : The data linked to your bank card are retained for 13 months by our payment service providers after the last debit date for proof purposes in the event that the transaction is disputed (15 months in the case of deferred debit payment cards). The cryptogram is not retained after the transaction. |
Satisfaction surveys | Legitimate interest | Time required to achieve the survey objective, then anonymized. |
Sending newsletters / prospecting campaigns by e-mail or other messaging services
If you have accepted cookies, you can also receive email reminders if you have not completed a purchase. | Consent, or legitimate interest if you are a customer who has purchased a product on our website or our mobile application | 3 years for potential customers and 5 years for customers, from the date of your last contact with us (e.g. a request for commercial documentation, a click on a hyperlink in our newsletter). |
Customer Complaints and After Sales Service | Fulfilment of the contract | 1 year after the request has been handled |
Social Media Animation | Legitimate interest | 5 months |
Preparation of statistics | Legitimate interest | Time required to achieve the objective of the statistics, then anonymized. |
Customisation of navigation/profiling | Consent | 13 months |
Use of the public WiFi that we make available to you | Fulfilment of the contract | For the duration of using the service |
Photos taken for the production of the annual pass | Fulfilment of the contract | 6 months after the expiration date of the pass (if the pass is renewed, the photo can be saved and used again) |
Pictures taken of visitors on attractions | Fulfilment of the contract | Photos are kept for 7 days. when purchasing the photo: 7 days from the date the photo was taken |
Video/Photo shooting on-site | Consent | Allowed duration of use of the photo or video |
Hire of pushchairs and wheelchairs | Fulfilment of the contract | The day of the visit only. |
Attribution of Easy Access to visitors with disabilities | Fulfilment of the contract | The day of the visit only. For passholders : till the expiration date of the pass |
Rental of storage lockers | Fulfilment of the contract | The day of the visit only. |
Management of found and lost property | Fulfilment of the contract | 1 year after declaration of loss of your property |
Video surveillance | Legitimate interest | 1 month after recording the images |
Geolocation (only for mobile application ) | Consent | For the duration of the use of the mobile application (data is only stored on the visitor's device) |
First aid for visitors | Protecting a person's vital interests | Personal injury: until the end of a 10-year period from the date of injury. For property damage: for 5 years. |
Exercising your GDPR rights | Legal obligations | 10 years from the closing of the request. When proof of identity has been required, it will be deleted as soon as verification has been completed. |
Litigation management | Legitimate interest | Until all appeal options have been exhausted |
Application management | Legitimate interest | 2 years after data collection for non-withheld applications |
Cybersecurity – vulnerability reports | Legitimate interest | 6 years after receipt of a vulnerability notification |
Recording customer service telephone calls | Legitimate interest | 14 days after the recording |
Push notifications | Consent | If not logged in : Only while using the application on the day of the visit If logged in : 5 years |
Focus on profiling to customise our content:
We may customise the display of content on our website, send you newsletters or push notifications to your mobile phone tailored to your interests.
We only perform this customisation based on the information we have collected directly from you during your purchases (and only this information), and based on your browsing behaviour on our website or our mobile application, once you have accepted cookies.
This information also allows us to better tailor our advertising campaigns on third-party sites (e.g. social networks) to your areas of interest.
Although the family dimension of our activities is at the heart of our concerns, we do not process any data specifically relating to children.
When our services are being used by persons under the age of 16, we recommend that they be accompanied by an adult. The consent of parents or legal guardians may be obtained when their personal data are collected, if necessary.
All your personal data is stored exclusively on servers in the European Union or in countries offering an "adequate" level of protection (e.g. the United Kingdom, Switzerland).
Although hosted in the European Union, this data may be accessible from third countries when we use technical service providers (e.g. AWS, Adobe, Microsoft, Google) located abroad (e.g. United Kingdom, United States, Israel). Access from these countries is considered data transfer but is necessary for the proper operation and maintenance of the IT tools they provide. These service providers have real expertise that justifies their involvement.
We make every effort with these service providers to ensure that your data are protected in accordance with European regulations. These service providers only act within the framework of our instructions. Contracts are systematically signed with the latter, and transfers of personal data are governed by enhanced contractual clauses specifically designed for this purpose (standard contractual clauses - SCCs - published by the European Commission) where the laws of the country in question do not offer protection equivalent to the GDPR (so-called “adequate” countries). If necessary, additional technical or legal measures are put in place.
The security of your personal data is a central concern for the companies in the Compagnie des Alpes group, which pool their resources to ensure that you benefit from an appropriate level of security that is up to date with the state of the art.
In order to preserve the confidentiality and security of your personal data, and notably to protect them against unlawful or accidental destruction, accidental loss or alteration, or unauthorised disclosure or access, the Compagnie des Alpes Group takes appropriate technical and organisational measures, and imposes the same level of requirements on its subcontractors. These measures are adapted according to the sensitivity of the data processed and the risk level.
The Compagnie Group has put in place procedures to detect, analyse, and monitor security incidents and any suspected breach of your personal data, and to be able to block access to the data at any time. Procedures for managing personal authorisations have also been put in place to ensure that access to data is as restricted as possible.
Despite our efforts, vulnerabilities may still be present in our systems. If you think that you have detected a vulnerability, please contact us using this form, while respecting the principles described there.
You have a number of rights in relation to your personal data held by us:
You will find all of our contact details below for the exercise of these rights.
Do you have a question? Would you like to stop receiving our newsletters? Delete your account?
We have appointed a Data Protection Officer to answer all of your questions and ensure the protection of your personal data.
To contact this person, click here.
Please fill in the form provided for this purpose, and your request will be processed within one month. For mobile apps, don't forget that you can change your authorisations at any time from your telephone's settings, for each of your apps.
You can also reach our DPO:
Or
If there are serious doubts about your identity, and if it cannot be done otherwise, you may be asked to provide proof of identity for the processing of your request, simply to ensure that we are dealing with the right person.
If, despite our efforts, you feel that our response is incomplete, you can contact the Data Protection Authority : Autoriteit Persoonsgegevens https://www.autoriteitpersoonsgegevens.nl/en/contact
