Privacy and cookie policy

Introduction

Maison Lemans (maisonlemans.fr) is committed to protecting your privacy. This policy explains what data this website and the house’s bookings collect, what it is used for, who receives it and how long it is kept, as well as the cookies and similar technologies the website uses.

Data Controller

The data controller, for this website as for the house’s bookings, is Anthony Razafindramanana, sole trader (SIREN 844 524 488), based at 18 avenue de Maignon, 64600 Anglet, France, one of the two hosts of the house. For any questions regarding your personal data, please use our contact form or call +33 7 75 77 76 59.

The data we collect

The contact form

When you write to Anthony, the form sends your name, your email address, the subject and your message, so that he can reply. The message goes out by email, from the Gmail (Google) mailbox of CrushCode, which built the site and maintains it, to Anthony’s inbox; CrushCode’s mailbox keeps a copy. The site does not store it in any database.

All fields are needed to handle your request.

Protection against abuse

The contact form uses Cloudflare Turnstile to protect against spam. Cloudflare’s script loads as soon as you open the contact page, and the check runs when you send your message: both times, your IP address and technical data from your browser reach Cloudflare. This service sets no advertising cookie and does not profile visitors.

Your IP address is also used to limit sending to five messages per minute: a temporary counter, kept by Upstash, deletes itself after about two minutes.

The date search

The date search on the home page is a module of Lodgify, the house’s booking software, loaded from Lodgify’s servers: your IP address and technical loading data reach Lodgify.

Bookings

When you book the house, Anthony receives your booking data: your identity and contact details, the dates of your stay, the number of guests and, for a direct booking, the payment, which you make on Lodgify’s payment page, through Stripe. This data is used to carry out the rental, keep the accounts, declare the tourist tax and, for a guest from abroad, fill in the police registration form if it is requested.

For direct bookings, Lodgify, the booking software Anthony uses, processes this data on his behalf, as a processor: Anthony remains the controller.

If you book through Airbnb or Booking.com, these platforms first process your data under their own privacy policies, then pass your booking details on to Anthony.

Audience measurement

The site measures its traffic with Vercel Web Analytics, a cookie-free tool that only produces aggregate statistics: page views, referring page, country, device and browser type.

Hosting

The site is hosted by Vercel Inc., in the United States. Like any host, Vercel processes the technical data of each visit (IP address, browser, requested page) to serve the pages and protect the site.

Why, and on what legal basis

• Replying to your message: steps taken at your request before a possible booking, or our legitimate interest in answering the questions we receive (Article 6(1)(b) and (f) GDPR).
• Carrying out your booking (your welcome, your stay, our exchanges): the rental contract (Article 6(1)(b) GDPR).
• Keeping the accounts, declaring the tourist tax and, for a guest from abroad, filling in the police registration form if it is requested: our legal obligations (Article 6(1)(c) GDPR).
• Protecting the form and the site (spam check, sending limit, the host’s technical data): our legitimate interest in the security of the site (Article 6(1)(f) GDPR).
• Measuring traffic without cookies: our legitimate interest in knowing the site’s audience (Article 6(1)(f) GDPR).
• Technical cookies: necessary for the site to work, they are exempt from consent (Article 82 of the French Data Protection Act).

Who receives your data

Anthony, who reads the messages, replies to them and manages the bookings. And, only for the technical part that concerns each of them: CrushCode, which built the site and maintains it, Google (sending emails), Cloudflare (spam check), Upstash (sending limit), Vercel (hosting and audience measurement), Lodgify (date search and direct bookings) and Stripe (payment of direct bookings).

Some of our providers are based in the United States or process data there: Vercel (hosting and audience measurement), Google (emails), Cloudflare (spam check), Upstash (sending limit) and Stripe (payment). These transfers rely on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for providers certified under it, and on the standard contractual clauses adopted by the European Commission, included in their data processing terms.

How long

• Contact form messages: 3 years from our last exchange with you, then deleted.
• The copy kept by CrushCode’s mailbox, from which the messages are sent: deleted within the same period.
• Bookings: the stay, then 5 years as proof of the contract; invoices 10 years.
• Police registration form of a guest from abroad, if filled in: 6 months (article R. 611-42 of the CESEDA).
• The host’s technical logs: 30 days at most.
• Sending-limit counter (Upstash): the length of the rate-limit window, about two minutes; it then deletes itself.
• Audience measurement (Vercel Web Analytics): aggregated statistics only; the technical identifier, computed without a cookie, changes every day.
• Cookies: the duration shown in the table below.

Cookies

This site only sets cookies that are strictly necessary for it to work:

Cloudflare’s Turnstile spam check runs on the contact page to protect the form. Audience measurement uses Vercel Web Analytics, without cookies or any identifier stored on your device. These are exempt from consent (article 82 of the French Data Protection Act), which is why no banner asks you for it. If a tracker requiring consent were ever added, it would only load after you agree.

Lodgify’s date search, on the home page, loads from Lodgify’s servers: your IP address and technical loading data reach Lodgify, but no cookie is set when it is displayed. The booking and payment page is on Lodgify’s website, which applies its own cookie policy there.

Your Rights

You can ask to access your data, to have it corrected or erased, to restrict its processing and to receive it in a portable format, and you can object to its processing. You can also set instructions on what happens to your data after your death (article 85 of the French Data Protection Act).

To exercise these rights, write to Anthony through the contact form or at ccrushcode@gmail.com.

You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).