Legal Notice

1. Preamble

 

This Privacy Policy aims to inform users about how their Personal Data is collected from the Site, how it is processed by the Publisher, and finally, the rights that users have regarding these processes as defined below.

 

 

2. Definitions

 

The following terms, whether used in the singular or plural in this Privacy Policy, shall have the following definitions:

 

• Intermediate Archiving: Refers to the transfer of Personal Data, which still holds administrative value for the Publisher (such as in the event of litigation and/or legal obligation), into a separate database, either logically or physically separated, with restricted access. This archive is an intermediate step before the deletion or anonymization of the concerned Personal Data.
• Privacy Policy: Refers to this privacy and personal data protection policy implemented by the Publisher.
• Personal Data: Refers to the personal data of the user collected and processed by the Publisher as defined in the Privacy Policy.
• Specific Rights: Refers to the rights granted to users by the Personal Data Regulation concerning the processing of their Personal Data.
• Personal Data Regulation: Refers to Law No. 78-17 of January 6, 1978, on Information Technology, Data Files, and Civil Liberties, as amended by Law No. 2018-493 of June 20, 2018, on personal data protection, in application of the Community Regulation of April 27, 2016, published in the Official Journal of the European Union on May 4, 2016, concerning the protection of individuals with regard to the processing of personal data and the free movement of such data (known as the "GDPR" for General Data Protection Regulation).
• Terminal(s): Refers to the hardware equipment (computer, tablet, smartphone, phone, etc.) used by the user to access or display the Site and/or any other digital medium published by a third party.
• User: Refers to all Internet users and visitors to the Site.

 

 

3. Legal Bases for Processing by the Publisher

 

In accordance with the Personal Data Regulation, the processing activities described in this Privacy Policy are supported by specific legal bases.

 

The use of the website is necessarily governed by a contractual relationship between the user and the Publisher, which serves as the legal basis for the collection and processing of the user's Personal Data for the proper functioning of the Site and the provision of associated services.

 

Processing of Personal Data may also be necessary to comply with a legal obligation to which the Publisher is subject.

 

Furthermore, the processing of the user's Personal Data may be necessary for the purposes of legitimate interests pursued by the Publisher or a third party, unless the interests or fundamental rights and freedoms of the user, which require protection of Personal Data, prevail, especially when the user is a child.

 

For example, processing of Personal Data strictly necessary for fraud prevention constitutes a legitimate interest of the Publisher.

 

In the case of processing based on the legitimate interest of the Publisher or a third party, the Publisher ensures that the processing is necessary for achieving its legitimate interest and evaluates the impact of such processing on the user, including considering the nature of the Personal Data processed and how it is processed.

 

The Publisher ensures not to disregard the user's interests or fundamental rights and freedoms by allowing the user, at any time, to oppose all or part of the processing described in this Privacy Policy, as well as to exercise their Specific Rights, under the conditions set out in Article 9 below.

 

 

4. Purposes of Processing by the Publisher

 

The user's Personal Data is necessary to grant them access to the Site, its use, and its improvement, and to enable the Publisher to provide the services detailed on the Site.

 

The operations described below are not used to create profiles that could reveal sensitive Personal Data, such as racial or ethnic origins, philosophical, political, trade union, religious opinions, sexual life, or health, and they are not used to make automated decisions by the Publisher.

 

 

5. Storage of Personal Data

 

The Site is hosted by OVH.

 

All precautions have been taken to store users' Personal Data in a secure environment and to prevent it from being altered, damaged, or accessed by unauthorized third parties. The information provided by the user will never be shared with third parties for commercial purposes, nor sold, nor exchanged.

 

 

6. Collection of Personal Data on the Site

 

The Publisher collects the Personal Data that the user voluntarily provides on the Site.

 

This Personal Data is retained by the Publisher for a period of two (2) years in active storage, starting from the date it is provided on the Site.

 

The relevant Personal Data is then kept in Intermediate Archiving for an additional three (3) years in accordance with the common prescription period.

 

If necessary, the Publisher may decide to retain this Personal Data for a longer period in legal Intermediate Archiving, to comply with a legal obligation (e.g., Article L.123-22 of the Commercial Code, which requires that "Accounting documents and supporting documents are kept for ten years") or to establish proof of a right or contract.

 

Only the Personal Data designated as mandatory on the Site is essential to benefit from the services provided on the Site.

 

 

7. Recipients or Categories of Recipients of Personal Data

 

The user's Personal Data is shared with the Publisher's subcontractors, namely:

 

• AYS (Klixi), a simplified joint-stock company with a capital of €50,000, headquartered at 18, rue de Londres, 75009 Paris, France, registered with the Paris Trade and Companies Register under number 535 351 472.

  • Function: Developer and management and administration tool for the Site by the Publisher.
  • Data Transfer Outside the EU and Specific Guarantees: No.

• Amazon Web Services LLC (AWS), P.O. Box 81226, Seattle, WA 98108-1226.

  • Function: Site hosting.
  • Data Transfer Outside the EU and Specific Guarantees: Yes – Privacy Shield.

 

If applicable:

 

• Stripe Payments Europe, Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

  • Function: Payment module.
  • Data Transfer Outside the EU and Specific Guarantees: No.

• Mandrill, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308 USA.

  • Function: Allows the Publisher to send email campaigns to users who have provided their email address.
  • Data Transfer Outside the EU and Specific Guarantees: Yes – Privacy Shield.

• TextMagic, TEXTMAGIC LTD, Salisbury House Station Road, Cambridge CB1 2LA, United Kingdom, VAT Reg No: GB851556810, Company No: 05286521.

  • Function: Allows the Publisher to send SMS campaigns to users who have provided their phone number.
  • Data Transfer Outside the EU and Specific Guarantees: No.

• Stuart, SRT GROUP, 8 avenue des Ternes, 75017 Paris.

  • Function: Allows the Publisher to use Stuart as a rapid delivery service.
  • Data Transfer Outside the EU and Specific Guarantees: Not Communicated.

• TacTill, 8 Bis Chemin de la Justice, 91940 Gometz-le-Châtel.

  • Function: Allows the Publisher to receive e-commerce orders placed on the Site directly on their TacTill cash register.
  • Data Transfer Outside the EU and Specific Guarantees: No.

• Fülle, SARL FULLE, 85 Impasse Leydier, 38850 Saint-Chef.

  • Function: Allows the Publisher to benefit from Fülle services.
  • Data Transfer Outside the EU and Specific Guarantees: No.

• Snapshift, SNAPSHIFT SAS, 21 Rue La Boétie, 75008 Paris.

  • Function: Allows the Publisher to benefit from Snapshift services.
  • Data Transfer Outside the EU and Specific Guarantees: No.

 

The Publisher regularly ensures that these recipients comply with the Data Protection Regulations. The Publisher is committed to not disclosing, transferring, or transmitting the user's Personal Data without their prior consent and to not using it for purposes not provided for in this Privacy Policy.

 

 

8. User Rights

 

In accordance with Data Protection Regulations, the user has the following Specific Rights:

 

• Right of Opposition: The user can object at any time, for reasons related to their particular situation, to the processing of Personal Data concerning them based on the legitimate interest of the Publisher. They can also object to the processing of Personal Data concerning them for prospecting purposes.
• Right to Withdraw Consent: When processing is based on the user’s consent, the user has the right to withdraw their consent at any time.
• Right of Access: The user has the right to obtain from the Publisher confirmation of whether their Personal Data is being processed or not, and when it is, to access their Personal Data and certain information, including the purposes of the processing, the categories of Personal Data concerned, etc.
• Right to Rectification: The user has the right to obtain from the Publisher, without undue delay, the rectification of inaccurate Personal Data concerning them. The user also has the right to obtain that their incomplete Personal Data be completed, including by providing a supplementary statement.
• Right to Erasure: In certain cases, the user has the right to obtain from the Publisher the erasure of their Personal Data, for example, when the Personal Data is no longer necessary in relation to the purposes for which it was collected.
• Right to Restriction of Processing: In certain cases, the user has the right to obtain from the Publisher the restriction of the processing of their Personal Data.
• Right to Data Portability: The user has the right to receive the Personal Data concerning them that they have provided to the Publisher, in a structured, commonly used, and machine-readable format, and has the right to transmit this Personal Data to another data controller (e.g., another website) without hindrance from the Publisher.

 

These Specific Rights can be exercised by the user by sending an email to info@chateaurepotel.com.

 

The user also has the right to give general or specific directives regarding the fate of their Personal Data after their death.

 

 

9. Security of Personal Data

 

The Publisher implements all necessary technical and organizational measures to protect users' Personal Data against unauthorized access, alterations, disclosures, or destructions.

 

These measures include, in particular, data encryption, restricted access management, and archiving of Personal Data under high-security conditions.

 

 

10. Changes to the Privacy Policy

 

The Publisher reserves the right to modify this Privacy Policy to adapt to legislative and regulatory changes, as well as changes related to the processing of Personal Data. Users are advised to regularly review this Privacy Policy to be aware of any changes.