Privacy policy

01

Data controller

The data controller is SARL LA VILLA DE PINARELLO (Le Petit Pinarello), a limited liability company with share capital of 20 000 €, RCS Ajaccio 837 873 389, SIRET 837 873 389 00014, whose registered office is at 8 rue François Pietri, 20090 Ajaccio, France.

For any questions about your personal data: lepetitpinarello@orange.fr · +33 6 19 56 56 06.

02

Data we collect

We only collect the data needed for your stay and for running the website:

• Booking requests and bookings (booking engine form): first name, last name, email address, phone number, dates of stay, number of guests (adults, children), any message, as well as the booking details (amounts, status, payment history).
• Payment: payment is made on the secure page of our provider Stripe. We only receive the status, amount and reference of the payment and, where a deposit is paid, the customer ID assigned by Stripe to collect the balance. Your card details never pass through our website and are never stored on it.
• Guest area: guest account (name, email address), messages exchanged with us and attachments, documents relating to your stay (invoices).
• Newsletter: your email address.
• Direct exchanges: the content of emails, messages or calls you send us.
• Technical data: IP address, browser type, pages viewed and server connection logs, technical cookies.

03

Purposes and legal bases

• Responding to your requests, preparing a quote, managing your booking, your stay and our exchanges (confirmation emails, practical information, messages): performance of the contract or of pre-contractual measures (GDPR art. 6.1.b).
• Collecting the deposit, the balance and any extras, and preventing payment fraud: performance of the contract and legitimate interest (art. 6.1.b and f).
• Issuing invoices and complying with our accounting, tax and legal obligations: legal obligation (art. 6.1.c).
• Sending you our newsletter: your consent (art. 6.1.a), which you may withdraw at any time.
• Ensuring the security of the website and preventing abuse (anti-spam protection of forms, technical logs): legitimate interest (art. 6.1.f).
• Handling your requests to exercise your rights: legal obligation (art. 6.1.c).

Your data is never subject to automated decision-making or profiling, and is never sold or rented.

04

Recipients

Your data is intended for authorised staff of SARL LA VILLA DE PINARELLO in charge of bookings and welcoming guests. It is also processed, on our behalf and according to our instructions, by the following providers:

• Hostinger International Ltd. (Cyprus): hosting of the website and its database, and sending of emails relating to your booking.
• Stripe Payments Europe Ltd. (Ireland): secure payment processing. Stripe also acts as data controller for its own obligations (fraud and money-laundering prevention): Stripe privacy policy.
• Google (Google Fonts): the website’s fonts are loaded from Google’s servers, which receive your IP address and technical information about your browser in the process.

Finally, it may be disclosed to administrative or judicial authorities where required by law.

05

Transfers outside the European Union

Some providers (Stripe, Google) may process data in the United States. These transfers are governed by the European Commission’s adequacy decision on the EU–US Data Privacy Framework and, where applicable, by the European Commission’s standard contractual clauses.

06

Retention periods

• Enquiry not followed by a booking: 3 years from our last exchange.
• Booking and guest data: for the duration of the contractual relationship, then 5 years from the end of the stay (standard statutory limitation period).
• Invoices and accounting records: 10 years from the close of the financial year (article L123-22 of the French Commercial Code).
• Guest area: for as long as you have a booking in progress, then up to 3 years of inactivity or until you ask for deletion. Login links sent by email are single-use and expire after 30 minutes.
• Newsletter: until you unsubscribe or, failing that, 3 years after our last contact.
• Technical server logs: 12 months maximum.

At the end of these periods, data is deleted or anonymised. Where a booking must be kept for accounting purposes, identification data is anonymised and only the legally required items (invoice) are kept.

07

Secure payment

Payments are made through Stripe, a PCI-DSS certified payment provider. You are redirected to a payment page hosted by Stripe and protected by encryption; strong authentication (3-D Secure) may be requested by your bank.

When you pay a deposit, Stripe securely stores the payment method needed to collect the balance under the terms accepted at the time of booking. Le Petit Pinarello never has access to your full card number.

08

Cookies and trackers

The website uses no advertising cookies, no audience measurement tools and no social media sharing buttons. Only the following technical cookies, which are strictly necessary and exempt from consent (article 82 of the French Data Protection Act), may be set:

• WP_SESSION_COOKIE: keeps your session active while you search and book — duration: 30 minutes.
• wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie: secure login to your guest area — duration of the session (up to 14 days if you choose to stay logged in).

On the payment page, Stripe sets its own cookies, which are necessary for transaction security and fraud prevention, under its own responsibility.

Links to Google Maps and Instagram are simple links: no content from these services is embedded in our pages and no data is sent to them unless you click. Once on their site, their own policies apply.

You can set your browser to block or delete cookies; online booking and access to the guest area may then no longer work.

09

Your rights

You have the following rights over your data at any time:

• right of access and to obtain a copy of your data;
• right to rectification of inaccurate or incomplete data;
• right to erasure of your data, subject to our legal retention obligations;
• right to restriction of processing;
• right to object to processing based on our legitimate interest;
• right to portability of the data you have provided to us;
• right to withdraw your consent at any time (newsletter), without affecting processing already carried out;
• right to set instructions regarding what happens to your data after your death.

To exercise these rights, write to us at lepetitpinarello@orange.fr or by post to SARL LA VILLA DE PINARELLO, 8 rue François Pietri, 20090 Ajaccio, France. We will reply within one month, which may be extended by two months if the request is complex. If there is reasonable doubt about your identity, proof may be requested.

10

Complaint to the CNIL

If, after contacting us, you feel that your rights have not been respected, you may lodge a complaint with the French data protection authority (Commission nationale de l’informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

11

Security

We implement appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), administration access restricted to authorised persons, single-use login links, anti-spam protection on forms and payment entrusted to a certified provider.