1. Data controller

Identity : [TO BE FILLED]
Address : [TO BE FILLED]
Email : [TO BE FILLED]

2. Data collected

When booking online, the following data is collected:

First and last name
Email address
Phone number (optional)
Booking date, time, and party size
Notes and special requests (optional)

This data is used exclusively to manage bookings and send confirmation emails.

3. Legal basis

Processing is based on contract performance (GDPR, art. 6.1.b): managing your booking constitutes the contractual relationship justifying the processing of your data.

4. Retention period

Booking data is kept for 3 years from the booking date, in accordance with applicable accounting and tax obligations, then deleted.

5. Your rights

Under the GDPR, you have the following rights:

Right to access your data
Right to rectification
Right to erasure ("right to be forgotten")
Right to portability
Right to object to processing

To exercise these rights, contact us at: [TO BE FILLED]. You can also file a complaint with the French CNIL (www.cnil.fr).

6. Cookies

This site uses session cookies required for the admin area and for maintaining your booking session. In addition, audience measurement cookies (Google Analytics) may be placed on your browser, but only after your explicit consent via the banner shown on your first visit. You can withdraw your consent at any time by clearing your browser cookies — the banner will then reappear on your next visit. No advertising cookies are placed.

7. Data transfers outside the EU

Some data may be transferred outside the European Union through the following services:

Vercel Inc. (USA) — site hosting. Vercel is certified under the EU-US Data Privacy Framework.
Brevo (Sendinblue SAS, France/EU) — confirmation email delivery. Brevo is a European GDPR-compliant provider.
Neon Inc. (AWS eu-central-1, Frankfurt, Germany) — database storage. Data stays in the EU.
Cloudflare Inc. — storage and delivery of client profile pictures. The bucket is configured under strict EU jurisdiction: files are stored only in EU datacenters and cannot be transferred outside the EU.
Google LLC (USA) — audience measurement via Google Analytics (GA4). Only activated after your explicit consent. Google is certified under the EU-US Data Privacy Framework. You can refuse this processing at any time via the cookie banner.

8. DPO contact

No Data Protection Officer (DPO) is appointed for this business. For any data-related question, contact the data controller directly at: [TO BE FILLED]

Privacy policy