This policy explains how your personal data is processed when you use lavillachristal.fr, request a booking or stay at Villa Christal, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act. This English version is provided for international guests. French law applies and the French version prevails in the event of any discrepancy.
1. Data controller
Christian FRANCOIS, sole trader (entrepreneur individuel) — Villa Christal (full details in the legal notice). Contact for any question about your data: contact@lavillachristal.fr.
2. Data collected
The booking form collects dates and the number of adults and children, then, once the price is shown, your first name, surname, postal address, country, telephone, email and language. Required fields are identified; practical information (bedroom configuration, vehicles, arrival time, baby cot, pool heating, electric vehicle, late arrival, message) is optional. As the booking progresses, the file also contains the agreement, proof of signature, payment references, invoices and correspondence.
Each request creates a file in the website’s WordPress database, hosted by Hostinger; it is not handled by email alone. Villa Christal never receives card details: card payments are made on Stripe’s secure page.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to a booking request or enquiry | Name, email, telephone, postal address, country, language, dates, number of adults and children (and children’s ages), optional practical information, message | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Preparing the offer and agreement, collecting the electronic signature | Request data, agreement, document fingerprints, proof of signature | Performance of the contract (Art. 6(1)(b)) |
| Collecting payments and issuing invoices | Amounts, payment reference and status, invoices (Villa Christal never receives card details) | Performance of the contract; legal obligation for accounting records (Art. 6(1)(c)) |
| Managing the security deposit | Amount, provision, release or deduction and supporting evidence | Performance of the contract; legitimate interest in defending the owner’s rights (Art. 6(1)(f)) |
| Organising your welcome and stay | Name, dates, occupants, arrival time, vehicles, bed configuration, options requested | Performance of the contract |
| Handling an incident, complaint or dispute | File, correspondence, reports and evidence | Performance of the contract, then legitimate interest (defence of rights) |
| Sending stay guide reminders, if you turn them on | Technical subscription address provided by your browser, language, stay dates | Consent, which you can withdraw at any time from the guide or your browser (Art. 6(1)(a)) |
| Measuring use of the discovery pages | Page type, language, filters, clicks and errors, with no visitor identifier or IP address | Legitimate interest in improving the website |
| Measuring website audience (pages viewed, referring source, path to the booking request) | Page views, referring website or campaign, device and browser type, language, approximate country and city derived from the IP address (not kept by the tool according to its provider), steps reached in the booking request without any data entered | Legitimate interest in improving the website (Art. 6(1)(f)) |
| Keeping the website secure and backed up | Host’s technical logs, database backup copies | Legitimate interest in securing the service |
No consent is requested to handle a request or booking: this processing is necessary for the contract. Your data is not sold, not used for advertising and not reused for marketing.
4. Recipients
| Recipient | Data concerned | Role |
|---|---|---|
| Christian FRANCOIS and the persons authorised by the operator to manage bookings | The whole file | Data controller |
| NLC Conciergerie Sarlat | Information needed for arrival, the stay and departure | Owner’s service provider, strictly as necessary |
| Hostinger (Lithuania, European Union) | Website, database of requests and bookings, contact@lavillachristal.fr mailbox | Hosting provider (processor) |
| Google (Gmail, Google Drive) | Notifications of requests and messages received at contact@lavillachristal.fr, forwarded to the operator’s mailbox; website database backup copies | Email and storage provider |
| Stripe | Card payment: name, email, amount; the card is entered directly with Stripe | Payment provider |
| DocuSeal | Electronic signature: name, email, agreement | Electronic signature provider |
| Umami Software, Inc. (Umami Cloud, United States) | Visit statistics described above | Audience measurement provider (processor) |
| Authorities, insurers, advisers | Where applicable and within the scope of their duties | Authorised recipients |
If you contact us through WhatsApp or Airbnb, those services process your messages under their own privacy policies.
5. Transfers outside the European Union
Some providers may process data outside the European Union, in particular in the United States: Google, Stripe (certified under the EU–US Data Privacy Framework) and DocuSeal depending on the instance used, as well as Umami (audience measurement), a US company several of whose technical providers are also American; for Umami, the transfer is covered by the European Commission’s standard contractual clauses included in its data processing agreement. These transfers rely on the safeguards these providers state that they apply, for example the Data Privacy Framework for Stripe.
6. Retention periods
| Data | Period | Justification or implementation |
|---|---|---|
| Request not followed by a booking | No later than 12 months after the last exchange | Currently deleted manually (no automatic deletion is in place yet) |
| Booking file, signed agreement and proof of signature | Until the end of the stay, then 10 years | Articles L.213-1 and D.213-2 of the French Consumer Code (electronic contract of €120 or more) |
| Invoices and accounting records | 10 years from the end of the financial year | Accounting and tax obligations |
| Practical stay information (arrival time, vehicles, options) | Kept with the booking file | Part of the same file |
| Card payment | Payment reference and proof kept with the file; card details are never received | Stripe’s own rules apply to the data it processes |
| Incident, complaint or dispute | Until finally resolved, then for the applicable limitation period (5 years under general French law) | Article 2224 of the French Civil Code |
| Email messages | Kept in the operator’s mailboxes, with no automatic deletion | Manual deletion in line with the periods above |
| Stay guide reminder subscription | Until 7 days after the end of the stay | Automatic deletion |
| Usage measurement | Raw events: 90 days; aggregated daily statistics: 13 months | Automatic daily deletion |
| Visit statistics (Umami) | 6 months | Automatic deletion by the provider |
| Website database backups | Rotation of the last 14 daily backups on Google Drive; one-off copies made before updates are kept in the private hosting space | The retention of one-off copies is not yet limited: scheduled deletion is planned |
| Server technical logs | Period set by the host | Not configured by Villa Christal |
7. Cookies and storage on your device
Public pages set no audience-measurement or advertising cookies. Traffic is measured with Umami, a cookie-free tool that does not track visitors across websites and only produces statistics: pages viewed, referring source, device type, approximate country and city. Web addresses are cleaned before sending (only “utm_” campaign parameters are kept) and nothing you type into the booking form is transmitted. The guests’ stay guide is not measured. Your browser is not counted if it sends a “Do Not Track” request. To opt out on this device: disable audience measurement; to opt back in: enable. This choice is stored in your browser and is lost if you clear its data.
Usage measurement on the discovery pages is hosted with the website: it masks searches that look like an email address, telephone number, URL or long string of digits, and uses no visitor identifier, full IP address or cross-site tracking.
The stay guide reserved for guests saves your programme in your browser’s local storage, on your device only, so that the service works; you can clear it in your browser settings. Reminders are sent only if you allow them in your browser.
8. Security
The website is served over HTTPS. Booking files and agreements are kept in a non-public area, accessible only to the persons who manage bookings. Card payments and electronic signatures are handled by specialised providers.
9. Your rights
You may request access to your data, rectification, erasure or restriction of processing, object to processing based on legitimate interest and, where applicable, exercise your right to data portability. Where processing is based on your consent (guide reminders), you may withdraw it at any time. Some data must nevertheless be kept to comply with a legal obligation (agreement, invoices).
To exercise your rights: contact@lavillachristal.fr. Proof of identity may be requested only where there is reasonable doubt about your identity. You may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
10. Changes
This policy may change, in particular if a new provider or feature is introduced. The date below is updated with each change.
Last updated: 6 October 2026.