1. Data Controller

The controller responsible for the processing of personal data collected through this website is:
SAS La Châtellenie de l’Épinay
2 rue de la Promenade
37310 Dolus-le-Sec
France
contact@chateau-domainelafayette.com

SAS La Châtellenie de l’Épinay determines the purposes and means of the personal data processing carried out in connection with the operation of the website, the handling of enquiries and the management of bookings.

2. Personal Data Collected

Depending on how you use the website, we may collect the following categories of personal data:
- first and last name;
- email address;
- telephone number;
- postal address;
- town or city;
- postcode and country;
- arrival and departure dates;
- number of adults and children;
- accommodation and services booked;
- booking amount and status;
- history of communications and enquiries submitted to the estate;
- information required for invoicing and accounting purposes;
- technical connection data, such as your IP address, browser, device and technical logs;
- cookie preferences and, where you have given your consent, audience measurement data.

Payment card details are entered directly into the secure environment of the payment service provider. The Château & Domaines Lafayette website does not store full payment card numbers or card security codes.

3. Purposes and Legal Bases of Processing

The personal data collected may be used for the following purposes:

Contact and Information Requests
The information provided through the contact form is used to respond to your questions, requests for information, quotation requests or enquiries concerning the organisation of a stay or event.
This processing is based on taking pre-contractual steps at your request and, depending on the nature of your enquiry, on the legitimate interest of the data controller in responding to requests received.

Bookings and Stays
The information collected during the booking process is used to:
- search for and check availability;
- record and manage the booking;
- manage and follow up your stay;
- communicate with the guest;
- manage changes, cancellations and any complaints;
- organise the accommodation, services and facilities booked.

This processing is necessary for the performance of the booking contract or to take pre-contractual steps at your request.

Payments and Invoicing
The information required for transactions is used to:
- prepare and monitor payment of the deposit;
- monitor payment of the outstanding balance;
- manage any refunds;
- issue invoices;
- comply with accounting, tax and legal obligations.

This processing is based on the performance of the contract and compliance with the legal obligations to which SAS La Châtellenie de l’Épinay is subject.

Website Security and Operation
Certain technical data may be processed in order to:
- ensure the security of the website;
- prevent fraudulent access;
- detect technical errors;
- maintain the website and ensure continuity of service.

This processing is based on the legitimate interest of the data controller in maintaining a secure and functional website.

Audience Measurement
Where audience measurement tools that are not exempt from consent are used, the corresponding trackers are only placed after obtaining your consent.
You may refuse these trackers or withdraw your consent at any time using the cookie management tool available on the website.

4. Mandatory Information

Fields marked as mandatory in the forms are required to process your enquiry or booking.
If this information is not provided, we may be unable to respond to your request, register your booking or provide the requested services.
Other fields are optional and help us better understand your request or personalise the service provided.

5. Recipients of Personal Data

Personal data may only be accessed by authorised personnel within SAS La Châtellenie de l’Épinay and, where necessary, by its technical and contractual service providers.
These recipients may include:
- the website hosting provider;
- service providers responsible for website maintenance and security;
- the booking management solution provider;
- the secure payment processing provider;
- accounting and administrative service providers;
- administrative or judicial authorities where disclosure is required by law.
Personal data is not sold to third parties.

Personal data is only shared to the extent necessary to provide the requested services, operate the website, process payments or comply with legal obligations.

6. Website Hosting

The website is hosted by IONOS.
Technical data required for hosting and operating the website may be processed as part of the services provided by the hosting provider.

7. Data Retention Periods

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected.
As a general guideline:
- contact enquiries are retained for the time required to process them and then for a maximum of three years from the last communication where they remain relevant for commercial or administrative purposes;
- booking data is retained throughout the contractual relationship and then archived for the periods necessary to manage potential claims and comply with legal obligations;
- invoices and accounting records are retained for ten years;
- technical data and security logs are retained for a limited period proportionate to their purpose;
- cookie preferences are retained for the period defined in the consent management tool;
- data associated with trackers is retained for the period specified in the Cookie Policy and the consent management tool.

Once these periods have expired, the data is deleted, anonymised or archived with restricted access where retention is required by law.

8. Data Security

SAS La Châtellenie de l’Épinay implements appropriate technical and organisational measures to protect personal data against:
- unauthorised access;
- disclosure;
- alteration;
- destruction;
- accidental loss;
- any other form of unlawful processing.

Access to personal data is restricted to individuals and service providers who require it in order to perform their duties or provide their services.

9. Your Rights

In accordance with the General Data Protection Regulation, referred to as the “GDPR”, and the amended French Data Protection Act of 6 January 1978, you have the following rights, subject to the conditions laid down by applicable law:
- the right to access your personal data;
- the right to rectify inaccurate or incomplete data;
- the right to request the erasure of your data;
- the right to restrict processing;
- the right to object to processing;
- the right to data portability in relation to data you have provided to us;
- the right to withdraw your consent at any time where processing is based on consent.

The withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, you may contact us:
By email: contact@chateau-domainelafayette.com
By post: SAS La Châtellenie de l’Épinay
2 rue de la Promenade
37310 Dolus-le-Sec
France

In order to protect your personal data, proof of identity may be requested where there is reasonable doubt concerning the identity of the person making the request.
You also have the right to lodge a complaint with the French Data Protection Authority, the Commission Nationale de l’Informatique et des Libertés, referred to as the “CNIL”.

10. Cookies and Other Trackers

The website may use cookies and other trackers in order to:
- ensure the technical operation of the website;
- remember certain preferences, including the selected language;
- secure forms and the booking process;
- measure website traffic where you have given your consent;
- improve the quality of the content and services provided.
Cookies that are strictly necessary for the operation of the website may be placed without consent where they meet the conditions laid down by applicable regulations.
Audience measurement, advertising and third-party cookies that require consent are only placed after obtaining your agreement.
When you first visit the website, a cookie banner allows you to:
- accept cookies requiring consent;
- refuse them;
- customise your preferences.

You may change your preferences or withdraw your consent at any time using the cookie management link available on the website.
Refusing non-essential cookies does not prevent access to the website’s main functions.
However, certain secondary features that rely on external services may remain unavailable until the relevant consent has been given.

11. Audience Measurement

If an audience measurement tool such as Google Analytics is enabled on the website, its use must respect the choices expressed through the cookie consent banner.
The corresponding trackers must not be placed before obtaining your consent unless they qualify for a legal exemption.
Information about the audience measurement tool actually used, the cookies placed, their purposes and their retention periods is available through the website’s cookie management tool.

12. Transfers of Personal Data Outside the European Economic Area

Some technical service providers may be established outside the European Economic Area or may process personal data outside this area.
Where such a transfer takes place, it is governed in accordance with applicable data protection legislation, including through an adequacy decision, standard contractual clauses approved by the European Commission or another safeguard recognised under the GDPR.

13. Updates to this Privacy Policy

This Privacy Policy may be updated to reflect changes to the website, the services provided, the service providers used or applicable legislation.

The version published on the website is the version currently in force.