Privacy policy

1. General information

Personal data means any information relating to an identified or identifiable person. We only process personal data where this is necessary to operate the website securely, respond to your enquiry, or prepare and provide a stay at Le Cougou.

We do not carry out automated decision-making, including profiling.

2. Data controller

The controller within the meaning of the GDPR is:

3. Website provision and hosting

Nature and purpose of processing

When you open the website, your browser transmits the technical data required by the web server. This may include your IP address, date and time of access, the requested page or file, the amount of data transferred, referrer URL, browser type, operating system and HTTP status code.

We process this data to deliver the website, maintain its stability and security, and identify and prevent abusive access.

Legal basis

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and user-friendly operation of this website.

Recipients and retention

Server logs are accessible only to authorised persons and, where applicable, contracted hosting and IT service providers. Log data is normally deleted within 14 days. Data relating to a security incident may be kept for longer until the incident has been fully resolved.

The website is operated in a self-managed Docker environment. The name and address of the hosting provider will be added to this policy once the corresponding contractual information has been finalised.

4. Contact and booking enquiries

Nature and purpose of processing

If you contact us using the contact form or by email, we process the information you provide in order to respond to your enquiry and any follow-up questions. First name, last name, email address and message are required in the form. Telephone number, preferred dates and number of guests are optional.

Form enquiries are stored in our self-hosted Directus content management system and its PostgreSQL database. They are not transmitted to Directus as an external cloud service.

Legal basis

Where your enquiry concerns a booking or potential stay, processing is based on Article 6(1)(b) GDPR for steps taken prior to entering into a contract. Other enquiries are processed under Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately to your message.

Retention

If no contract is concluded, we normally delete your enquiry no later than six months after it has been finally dealt with. If your enquiry results in a booking, the data required for the booking may be retained for longer to meet applicable accounting, tax and other legal obligations.

Providing your data

Providing your data is voluntary. Without the information marked as required, however, we cannot process your enquiry through the form.

5. Cookies and similar technologies

The public website does not use analytics, marketing or personalisation cookies, and it does not use local storage or comparable technologies to track your behaviour. A consent banner is therefore not displayed on the public website.

The administration area, which is restricted to authorised users, uses session functions that are strictly necessary for authentication and security.

6. Local fonts, media and CMS

The website does not load fonts from Google Fonts or another external font provider. It uses system fonts available on your device.

Images and other public media are delivered from our own web infrastructure. We do not embed external maps, video platforms, social media plugins, advertising networks or analytics services.

Directus and the database are self-hosted. Website content is read from the CMS during the protected publication process; internal credentials are never sent to your browser.

7. Recipients and international transfers

Personal data is available only to those who need it to respond to your enquiry or operate the website securely. Where hosting, email or IT providers process personal data on our behalf, they are engaged under a data processing agreement pursuant to Article 28 GDPR where required.

No transfer of personal data to recipients outside the European Union or European Economic Area is intended for the operation described in this policy.

8. Your rights

Subject to the legal requirements, you have the following rights in particular:

• access to your personal data,
• rectification of inaccurate or incomplete data,
• erasure of your data,
• restriction of processing,
• data portability,
• objection to processing, and
• withdrawal of consent with future effect.

Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise your rights, email contact@chateau-du-cougou.com. You also have the right to lodge a complaint with a data protection authority. In France, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).

9. Security and updates

We apply appropriate technical and organisational measures to protect personal data against loss, alteration and unauthorised access. Communication between your browser and the public production website is encrypted using TLS.

We update this policy when the website’s functions, service providers or legal requirements change.