Appart Lavande attaches particular importance to the confidentiality of your personal data. This policy describes what information we collect, how we use it, and the rights you have under the General Data Protection Regulation (GDPR).
1. Data controller
The data controller is Appart Lavande, reachable by email at [email protected] or by phone at +33 7 67 65 33 24.
2. Data collected
When using the site and during a booking, we may collect:
- Identity data: surname, first name, title
- Contact data: email, phone number, postal address
- Booking data: stay dates, chosen apartment, number of guests
- Payment data: handled exclusively by Stripe, never stored on our servers
- Technical data: IP address, browser type, pages viewed (anonymised statistics)
3. Processing purposes
Your data is used to:
- Manage your booking and related communication (before, during and after the stay)
- Issue invoices and process payment via Stripe
- Send you arrival instructions (digicode, wifi, instructions)
- Improve our service (anonymised statistical analysis of site traffic)
- Comply with legal obligations (invoice retention, tax)
4. Sharing with third parties
Your data is not shared with any third party for commercial purposes. It is only transmitted to the recipients the service needs:
- Stripe — payment processing
- Brevo — emails: booking confirmation, acknowledgement of your messages, copy of your messages to the host
- PassPass, hosted on Google Firebase — booking and property-access management (name, contact details, dates, number of guests)
- Telegram — the host's internal notifications: new bookings (name, contact details, dates) and chat messages (name, email, message)
- OpenAI — drafting a reply to your chat messages; the host reads and approves every reply before it is sent to you
- Competent authorities under a legal obligation
Bookings and chat messages are also stored on our own server (a database and the n8n automation tool, which we run ourselves). Some of the providers above may process data outside the European Union.
5. Retention period
Your booking data is retained for the duration necessary to perform the contract, plus legal retention periods (10 years for invoices, French Commercial Code). Beyond that, data is anonymised for statistical purposes.
6. Cookies
Our site uses two categories of cookies:
- Essential cookies — required for the site to function (session management, security). Placed without prior consent under the CNIL exemption for strictly necessary cookies.
- Audience measurement cookies — anonymous statistics to understand how the site is used. These cookies are only placed with your explicit consent.
On your first visit, a banner invites you to accept or refuse these cookies. You may change
your choice at any time by clicking "Manage cookies" at the bottom of any
page, or via your browser settings. Your consent is stored for 180 days in a first-party
cookie (lavande_consent).
7. Your rights
Under GDPR, you have the following rights regarding your data at any time:
- Right of access and rectification
- Right to erasure ("right to be forgotten")
- Right to restriction and opposition
- Right to data portability
- Right to lodge a complaint with the supervisory authority (CNIL)
To exercise these rights, contact us at [email protected].
8. Security
Your data is stored on secure servers (Hetzner, Germany), with in-transit encryption (HTTPS / TLS 1.3) and at-rest encryption. Access is protected by strong authentication.
9. Changes to this policy
This policy may be updated at any time. The last-updated date is shown at the top of this page.