Privacy policy

Introduction

At Suite B Spa, protecting your personal data is a priority. This privacy policy describes how we collect, use, share and protect your data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Data controller

The data controller for personal data collected on this website is Suite B Spa, a furnished-accommodation activity operated at 3 rue d'Estienne d'Orves, 83330 Le Beausset, France. Publication manager: Alban Tertre.

Contact: [email protected]

No Data Protection Officer (DPO) has been designated, as the scale and nature of the activity do not make this designation mandatory (GDPR article 37).

Data collected

We collect only data that is strictly necessary to provide our services:

When making a booking

• First and last name
• Email address
• Phone number
• Desired stay dates
• Options and preferences if applicable
• Payment information (handled exclusively by Stripe)

When sending a message via the contact form or chat

• Name
• Email address
• Message content

Browsing the site

• Anonymized technical data (browser type, pages visited, duration) collected via self-hosted Umami Analytics, without cookies and without any personal identifier

Purposes of processing

Your data is processed for the following purposes:

• Booking management and service delivery (legal basis: contract execution)
• Sending transactional emails (confirmations, reminders, invoices) via Resend (legal basis: contract execution)
• Responding to your inquiries via the contact form or chat (legal basis: legitimate interest)
• Anonymous audience measurement to improve the site (legal basis: legitimate interest)
• Compliance with our legal obligations (accounting, invoicing, record keeping)

Data recipients

Your data is never sold or shared with third parties for commercial purposes. It may only be transmitted to the following recipients, strictly necessary for service execution:

• Stripe (secure payments) — Stripe policy
• Resend (transactional email delivery) — Resend policy
• Our host OVH SAS (2 rue Kellermann, 59100 Roubaix, France) for technical storage. Data is hosted in France, within the European Union.
• Competent authorities in case of legal obligation

Retention period

• Booking data: kept for 3 years after the end of the commercial relationship, then archived for 10 years for accounting and tax obligations
• Contact messages: 3 years from the last exchange
• Anonymized navigation data: 13 months maximum

Security

We implement appropriate technical and organizational measures to protect your data against loss, alteration, disclosure or unauthorized access:

• HTTPS/TLS encryption of connections
• Strong authentication for administrator access
• Regular encrypted backups
• Access to data restricted to what is strictly necessary

Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of the data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data ("right to be forgotten")
• Right to restriction: restrict the use of your data
• Right to portability: receive your data in a structured and readable format
• Right to object: object to processing on legitimate grounds
• Right to withdraw consent at any time

To exercise these rights, send us a written request along with a copy of your ID to [email protected]. We will respond within a maximum of 30 days.

Complaint to the CNIL

If you consider that the processing of your personal data does not comply with the regulations, you have the right to lodge a complaint with the CNIL (French Data Protection Authority), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

Changes

We reserve the right to modify this policy at any time. Any changes will be published on this page with a new update date.