Privacy policy (GDPR)

Data controller

ECRIN DU LAC (Indivision entre personnes physiques, SIREN 988 854 527) — ecrin.du.lac@hotmail.com.

Data collected

Identity, contact details (email, telephone), information relating to the stay request (dates, number of guests, options) and payment tracking.

If you upload it, your insurance certificate is kept with your booking.

When you sign your contract online, the date, the time, your IP address and your browser are recorded. These elements constitute the proof of your signature: without them it would be impossible to establish later who signed, when, and that the contract has not been altered since. How long they are kept is set out below.

No card details are entered or stored on this site: card payment takes place on Stripe's pages, and the security deposit is handled by Tyllt.com, each under its own privacy policy.

Purposes

Handling booking requests, drawing up quotes and contracts, tracking payments, and communication relating to the stay (practical information, reminders).

Each processing operation rests on a legal basis: performance of the rental contract and the steps preceding it, for your file, your quotes, your payments and the messages relating to your stay; a legal obligation for accounting retention; our legitimate interest for the proof of your signature and for audience measurement.

Guest reviews

After a completed stay, we may invite you once to leave a review. Participation is optional and carries no reward. We process the booking reference, a rating, your comment, your permission to publish, and submission and moderation dates. The random link expires after 14 days and its token is not stored in plain text.

Publication is based on your consent. The review is moderated within 7 days. A low rating is never a reason for refusal: only a third party’s personal data, abuse, off-topic content, a duplicate, manifest fraud or illegal content may justify refusal. A published review remains online for no more than 5 years.

You may withdraw your consent and request removal of your review at any time by writing to ecrin.du.lac@hotmail.com. You may also report, free of charge, a reasoned concern about a review’s authenticity. We do not silently alter your text after submission.

Retention period

The insurance certificate you upload is deleted 12 months after your departure.

Your booking file and the record of your payments are kept for 10 years after the end of the stay, the period required by accounting obligations. The internal decision log and the proof of your electronic signature — date, time, IP address, browser — are deleted after 5 years, once the period during which a dispute could arise from the contract has passed.

These deletions are automatic: a daily task carries them out, with no action on our part.

Your rights

Under the GDPR, you have a right of access, rectification, erasure, restriction and objection. To exercise these rights, contact ecrin.du.lac@hotmail.com.

You may also request the portability of the data you have provided to us. If our reply does not satisfy you, you have the right to lodge a complaint with the CNIL, the French data protection authority — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

Audience measurement

We measure how the site is visited: number of visits, pages viewed, referrer and device type. These statistics are aggregated and tell us what our visitors are interested in.

At most two cookies are set, and neither is used to follow you: the first remembers your language, should you change it; the second remembers your answer to the question below, for six months, so that we need not ask it again on every page. Neither carries personal data, and neither follows your browsing from one site to another. No advertising cookie is used.

Processors

Stripe (card payment), Tyllt.com (security deposit management), Vercel (site hosting, audience and speed measurement), Neon (hosting of the booking database, within the European Union) and Resend (sending the messages relating to your booking: acknowledgement of receipt, reply to your request, instalment reminder and payment receipt).

Stripe, Vercel and Resend are established in the United States: your data may be transferred there. Depending on the provider, those transfers are governed by the European Commission's standard contractual clauses or by the EU—US Data Privacy Framework. The booking database itself never leaves the European Union.