Privacy policy
How your data is collected and used on the website chaletpoirie.com.
This policy describes how the personal data of visitors to the chaletpoirie.com website is collected and processed, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and French data protection law (loi Informatique et Libertés of 6 January 1978, as amended).
1. Data controller
The data controller is the website's publisher:
- Michel Sieben
- 815 rue de la Poirie, 88200 Dommartin-lès-Remiremont, France
- contact@chaletpoirie.com
- +33 6 21 01 10 31
Given the nature and scale of the processing involved (a showcase website for a furnished holiday rental, handling booking requests), appointing a data protection officer (DPO) is not mandatory. No DPO has been appointed at this time. [TO BE CONFIRMED: keep this wording or indicate a dedicated contact if the client prefers.]
2. Data collected, purposes and legal bases
The site only collects personal data when you provide it voluntarily, or strictly anonymously to measure site traffic.
2.1 Booking request form
When you fill in the contact / booking request form, the following data is processed:
| Data | Requirement |
|---|---|
| Name | Required |
| Email address | Required |
| Phone number | Optional |
| Requested arrival and departure dates | Optional |
| Number of travellers | Optional |
| Message (pets, baby equipment, special occasion, questions) | Optional |
- Purpose
- To handle your booking or information request, to contact you back in response, and, where applicable, to organise your stay.
- Legal basis
- Pre-contractual measures taken at your request (article 6.1.b GDPR). Since your request is a preliminary step toward a possible booking, no separate consent is required to process the data strictly necessary to respond to it. The checkbox on the form confirms that you have read this policy.
- Recipients
- The data is received by the website's publisher. It may also be processed by the technical provider that delivers the form: [TO BE CONFIRMED: name of the form service used, e.g. Formspree, or an internal back office. Verify its location and, if outside the European Union, the safeguards governing the transfer, e.g. standard contractual clauses.] It is never sold, transferred or used for advertising purposes.
- Retention period
- Unresolved requests are kept for a maximum of [TO BE CONFIRMED: retention period, recommended 12 to 36 months] from the last contact, then deleted. If your request leads to a stay, the data needed for the contractual relationship is kept for as long as necessary to manage it and to meet our legal obligations.
2.2 Direct contact by phone or email
If you contact us directly by phone or at contact@chaletpoirie.com, the information you provide is used solely to respond to your request, on the same basis of pre-contractual measures or our legitimate interest in responding to correspondents.
2.3 Anonymous audience measurement (cookie-free)
The site uses a privacy-friendly audience measurement tool that does not set any cookie and does not allow you to be identified. It relies on an anonymous, rotating technical identifier, recalculated daily from non-identifying information (truncated IP address, browser type, date, and an internal secret value), and never stores your full IP address.
- Purpose
- To measure, on a strictly statistical basis, the site's traffic (number of visits, pages viewed) in order to improve it. Campaign parameters (UTM) may be associated with a visit as campaign data, never as personal data.
- Legal basis
- The publisher's legitimate interest (article 6.1.f GDPR) in measuring the audience of its site.
- Cookies / consent
- This tool falls within the exemption from consent granted by the French data protection authority (CNIL) for audience measurement, as it does not track individuals and is used solely to produce anonymous statistics. It therefore operates without a banner and counts all visitors.
- Retention period
- Aggregated statistics are kept for a maximum of 13 months, in line with CNIL recommendations.
2.4 Detailed audience measurement (Google Analytics 4)
[Section conditional: only include if Google Analytics 4 is actually active on the site. If GA4 is not deployed at launch, this section must be removed so as not to announce a feature that does not exist.]
With your consent, the site may use Google Analytics 4 for a more detailed analysis of browsing activity.
- Purpose
- Detailed analysis of audience and browsing behaviour.
- Legal basis
- Your consent (article 6.1.a GDPR), collected via the cookie banner.
- How it works
- No Google script is loaded and no cookie is set until you have given your consent. You can withdraw your consent at any time via the cookie management link (see section 6).
- Recipient
- Google Ireland Limited. Data may be transferred outside the European Union, subject to the safeguards provided by Google (standard contractual clauses, applicable adequacy decision).
- Retention period
- [TO BE CONFIRMED: retention period configured in GA4, e.g. 14 months.]
3. No online sales
The site does not offer online payment or booking with online payment collection. It only allows you to send a booking request. No banking data is collected on the site. Bookings made through third-party platforms (Airbnb, Booking.com) are subject to those platforms' own privacy policies.
4. Recipients and processors
Your data is only accessible to the publisher and, where applicable, to its technical providers acting as processors under the GDPR:
- the website's host: [TO BE CONFIRMED, see legal notice];
- the form delivery service: [TO BE CONFIRMED, see section 2.1];
- where applicable, the provider of consented audience measurement: [TO BE CONFIRMED, only if GA4 is active].
No data is transferred or sold to third parties for commercial purposes.
5. Transfers outside the European Union
Other than the cases mentioned above (services that may be located outside the EU, subject to appropriate safeguards), your data is hosted and processed within the European Union. [TO BE CONFIRMED: to be adjusted according to the actual location of the host and the form service.]
6. Cookies and trackers
The site keeps its use of cookies to a strict minimum. Details of the cookies used, their purpose and how to manage your choice are set out in our cookie management system, described below and adjustable at any time.
6.1 Strictly necessary cookies
Only cookies or information strictly necessary for the site to function may be set without your consent (for example, remembering your cookie choice). They are never used for advertising tracking.
6.2 Cookies subject to consent
No cookie for detailed audience measurement, tracking or advertising is set without your prior consent. [TO BE CONFIRMED: if no cookie subject to consent is used at launch (anonymous audience measurement only, no GA4), state this clearly; the cookie banner then becomes unnecessary. If GA4 or session recording is activated, the banner described in rgpd-cookies.md applies.]
6.3 Manage your preferences
Where a cookie management banner is present, you can change or withdraw your choice at any time via the "Manage cookie preferences" link available at the bottom of the page. You can also configure your browser to block cookies.
7. Security
The publisher implements reasonable technical and organisational measures to protect your data against loss, unauthorised access or disclosure, including encrypted transmission of the site (HTTPS).
8. Your rights
Under the GDPR, you have the following rights over your data:
- the right of access and information;
- the right to rectification;
- the right to erasure ("right to be forgotten");
- the right to restriction of processing;
- the right to object, in particular to processing based on legitimate interest;
- the right to portability of the data you have provided;
- the right to withdraw your consent at any time, where processing is based on it;
- the right to give instructions on what happens to your data after your death.
To exercise these rights, contact the publisher at contact@chaletpoirie.com or by post at the address given in section 1. A response will be provided within one month. Proof of identity may be requested if there is reasonable doubt about your identity.
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
9. Changes
This policy may be updated to reflect legal or technical developments. The version that applies is the one published on this page.
Last updated: [TO BE CONFIRMED: go-live date].