Privacy Policy

1. Introduction

The protection of your personal data is particularly important to us. This Privacy Policy informs you about the nature, scope and purposes of the processing of personal data in connection with visiting and using our website and the services offered through it, in particular the options for booking our holiday accommodation. Your personal data is processed exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR), the French Loi Informatique et Libertés in its version currently in force, and all other applicable data protection provisions.

This Privacy Policy applies to the website

www.refugekreizanavel.com

including all subpages as well as the functions and content offered through it.

General information

Personal data means any information relating to an identified or identifiable natural person.

This Privacy Policy explains in particular:

• what personal data we collect;

• the purposes for which we process it;

• the legal basis on which the processing is carried out;

• how long the data is stored;

• to which recipients the data may be disclosed, where applicable;

• what rights you have as a data subject.

Controller

The controller within the meaning of Article 4(7) GDPR is:

Gwen Haverkate

330 Rue Scrafic, 29760 Penmarch, France

Telephone: +49 17631260417

Email: kreizanavel.location@gmail.com

Website: www.refugekreizanavel.com

Collection of personal data

Personal data is collected, in particular, when you voluntarily provide it to us, for example:

• via the contact form;

• as part of a booking enquiry;

• when making a reservation;

• by email;

• by telephone.

In addition, when you visit the website, technical information is automatically processed by our IT systems.

This includes in particular:

• IP address;

• browser type;

• operating system;

• date and time of access;

• referrer URL;

• technical log data.

For the most part, this data is collected automatically as soon as you visit our website.

Purposes of data processing

Personal data is processed in particular for the following purposes:

• provision of a functional website;

• processing contact enquiries;

• processing and managing bookings;

• performance of contracts;

• payment processing;

• improvement of our online offering;

• statistical analysis of the use of the website;

• ensuring IT security;

• compliance with legal obligations.

Disclosure of personal data

Personal data is disclosed only insofar as:

• this is necessary for the performance of a contract;

• there is a legal obligation to do so;

• you have expressly given your consent;

• or we have a legitimate interest within the meaning of Article 6(1)(f) GDPR and no overriding interests of the data subject oppose the disclosure.

Where external service providers process personal data on our behalf, such processing is carried out exclusively on the basis of a data processing agreement pursuant to Article 28 GDPR.

Withdrawal of consent

Where the processing of personal data is based on your consent, you may withdraw that consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out up to the time of withdrawal. Right to object pursuant to Article 21 GDPR Where personal data is processed on the basis of Article 6(1)(e) or (f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons. Your rights Under the GDPR, you have in particular the following rights:

• right of access (Article 15 GDPR);

• right to rectification (Article 16 GDPR);

• right to erasure (Article 17 GDPR);

• right to restriction of processing (Article 18 GDPR);

• right to data portability (Article 20 GDPR);

• right to object (Article 21 GDPR);

• right to withdraw consent that has been given (Article 7(3) GDPR).

You also have the right to lodge a complaint with a competent data protection supervisory authority.

For controllers established in France, the competent supervisory authority is generally: Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Irrespective of the above, you may also contact the supervisory authority responsible for your habitual place of residence within the European Union.

2. Processors

For the provision of our website and our services, we use carefully selected external service providers (processors), which process personal data exclusively in accordance with our instructions and on the basis of a contract pursuant to Article 28 GDPR.

The service providers used include, in particular, providers in the following areas:

• hosting;

• booking management;

• payment processing;

• web analytics;

• mapping services.

All processors we use are required to implement appropriate technical and organisational measures to protect personal data.

3. Definitions

To improve the readability of this Privacy Policy, we use the data protection terms defined in Article 4 GDPR. In particular, the following definitions apply:

Personal data

Any information relating to an identified or identifiable natural person.

Processing

Any operation or set of operations performed on personal data, whether or not by automated means, for example collection, recording, use, transmission or erasure.

Controller

The natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor

A natural or legal person who processes personal data on behalf of the controller.

Consent

Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject agrees to the processing of their personal data.

Website

The entire online offering available under the domain name stated above, including all subpages and functions.

End device

Any device capable of accessing the internet, for example a computer, smartphone or tablet.

4. Hosting

To provide our online offering, we use the services of an external hosting provider.

The hosting provider is:

STRATO AG

Otto-Ostrowski-Straße 7

10249 Berlin Germany

When you visit our website, personal data that is technically necessary to provide the website to you and to ensure its stability and security is automatically processed. This includes in particular:

• IP address;

• date and time of access;

• browser type and browser version;

• operating system;

• referrer URL;

• pages accessed;

• amount of data transferred;

• HTTP status code.

• Processing is based on Article 6(1)(f) GDPR.

Our legitimate interest lies in providing our online offering securely, reliably and efficiently.

A data processing agreement pursuant to Article 28 GDPR has been concluded with the hosting provider.

Further information about data processing by STRATO can be found at: https://www.strato.de/datenschutz/ 5.

Legal bases for data processing

Personal data is processed exclusively on the basis of the General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés.

Depending on the purpose of the processing, we rely in particular on the following legal bases:

Article 6(1)(a) GDPR

Processing based on your freely given consent.

This applies in particular to:

• cookies and tracking technologies;

• web analytics;

• newsletter;

• where applicable, other services requiring your consent.

You may withdraw consent that you have given at any time with effect for the future. Article 6(1)(b) GDPR Processing is carried out where it is necessary for the performance of pre-contractual measures or for the performance of a contract.

This applies in particular to:

• booking enquiries;

• reservations;

• contract administration;

• payment processing;

• communication with guests.

Article 6(1)(c) GDPR

Processing is carried out in order to comply with legal obligations, in particular tax and commercial-law retention obligations.

Article 6(1)(f) GDPR

Processing may also be carried out in order to safeguard our legitimate interests.

These include in particular:

• ensuring IT security;

• preventing misuse;

• error analysis;

• secure provision of the website;

• assertion and defence of legal claims.

Where a different legal basis applies to a particular processing operation, it is expressly stated in the relevant section of this Privacy Policy.

6. Transfers of data to third countries

In connection with the use of individual services, personal data may be transferred to recipients outside the European Union or the European Economic Area.

Such a transfer is carried out only if:

• the European Commission has adopted an adequacy decision;

• appropriate safeguards within the meaning of Article 46 GDPR are provided, in particular standard contractual clauses;

• or a statutory derogation under Article 49 GDPR applies.

Where we use services provided by companies established in the United States, personal data is transferred only if the applicable legal requirements are met. Where the relevant provider is certified under the EU-US Data Privacy Framework (DPF), the transfer of data is based on the adequacy decision of the European Commission.

Further information about the respective recipients can be found in the corresponding sections of this Privacy Policy.

7. Storage period

Personal data is stored only for as long as is necessary for the respective purposes of processing. Once the respective purpose no longer applies, the personal data is deleted unless statutory retention obligations or other legal grounds prevent its deletion.

In particular, data is stored:

• for as long as this is necessary to process a booking;

• for as long as statutory retention obligations apply;

• for as long as legitimate interests, for example the assertion or defence of legal claims, require it;

• or until consent that has been given is withdrawn.

After the applicable retention periods have expired, the data is routinely deleted or anonymised.

8. Technical and organisational security measures

We implement appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against loss, destruction, manipulation and unauthorised access.

These measures include in particular:

• encrypted data transmission;

• access restrictions;

• regular data backups;

• protection of IT systems against unauthorised access;

• access-rights management systems;

• continuous review and improvement of our security measures. In doing so, we observe the principle of data minimisation.

Only personal data that is necessary for the respective purpose is processed. Our security measures are continuously adapted in line with technological developments.

9. SSL/TLS encryption

To protect the security of your data and to ensure the secure transmission of confidential content, this website uses SSL or TLS encryption in accordance with the current state of the art. You can recognise an encrypted connection by the fact that your browser’s address bar begins with “https://” and a padlock symbol is displayed. Encryption prevents personal data that you transmit to us from being read or modified by unauthorised third parties.

10. Secure transmission of payment data

Where payments are processed via this website in connection with a booking, the payment data required for this purpose is transmitted exclusively via encrypted connections (SSL/TLS). The actual payment processing is carried out by the payment service provider you have selected. We process payment data ourselves only insofar as this is necessary for the performance of the contract.

11. Server log files

When you visit our website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically.

This includes in particular:

• IP address;

• date and time of access;

• browser type and browser version;

• operating system;

• referrer URL;

• pages accessed;

• HTTP status code;

• amount of data transferred;

• internet service provider.

This data is not combined with other data sources. Processing is based on Article 6(1)(f) GDPR.

Our legitimate interest consists in:

• ensuring the technical functionality of the website;

• detecting and preventing attacks on our IT systems;

• analysing errors;

• ensuring the long-term stability and security of the website.

The log files are stored only for as long as is necessary to achieve these purposes.

12. Cookies

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your end device and contain certain information.

They serve in particular to:

• provide the basic functions of the website;

• store your settings;

• enable bookings;

• ensure the security of the website;

• carry out statistical analyses;

• continuously improve our offering.

We distinguish between the following categories of cookies: S

trictly necessary cookies These cookies are essential for the operation of the website.

They enable in particular:

• navigation on the website;

• use of the booking system;

• security functions;

• storage of your cookie preferences.

Processing is based on Article 6(1)(f) GDPR. Statistics and analytics cookies Statistics cookies help us understand how visitors use our website. This enables us to continuously improve content and functionality. These cookies are set only after you have expressly given your consent. The legal basis for processing is Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future or change your cookie preferences. Managing your cookie preferences You can review and change your cookie preferences at any time via the corresponding link on our website. You can also delete cookies at any time in your browser settings or prevent them from being stored. Please note that this may restrict certain functions of the website.

13. Cookie consent management (Smoobu)

To manage your consent to the use of cookies and comparable technologies, we use the consent management system provided by:

Smoobu GmbH Pappelallee 78/79 10437 Berlin Germany

The consent management system is used to:

• obtain your consent;

• document your choices;

• comply with statutory evidence requirements;

• allow you to change your preferences at any time.

The following information is processed in particular:

• time at which consent was given;

• selected cookie preferences;

• pseudonymous identifier;

• browser information;

• IP address to the extent technically necessary.

Processing is carried out in order to comply with our legal obligations on the basis of Article 6(1)(c) GDPR and on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR in being able to demonstrate compliance with data protection requirements. You can change or withdraw your consent at any time with effect for the future.

Further information can be found in Smoobu’s Privacy Policy: https://www.smoobu.com/de/datenschutz/

14. Contact form and booking enquiries

You can contact us or submit a booking enquiry via our website. In this context, we process in particular the following personal data:

• first name;

• last name;

• email address;

• telephone number;

• desired travel period;

• number of guests;

• message;

• other information that you voluntarily provide to us.

This data is processed exclusively for the purpose of responding to your enquiry, taking pre-contractual measures and, where applicable, subsequently performing a rental agreement. The legal basis is Article 6(1)(b) GDPR. Where you voluntarily provide additional information, its processing is based on your consent pursuant to Article 6(1)(a) GDPR. The data is deleted as soon as it is no longer required to process your enquiry and no statutory retention obligations prevent deletion.

15. Contact by email or telephone

You can contact us by email or telephone. We process the personal data you provide to us exclusively for the purpose of responding to your enquiry and, where applicable, for taking pre-contractual measures or performing an existing contract.

Depending on the nature of your enquiry, the following data in particular may be processed:

• name;

• email address;

• telephone number;

• content of your message;

• other information that you voluntarily provide to us.

Processing is carried out:

• pursuant to Article 6(1)(b) GDPR where the contact relates to a booking or contractual relationship;

• otherwise, on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR in efficiently processing enquiries addressed to us.

The data is deleted as soon as it is no longer required to process the enquiry and no statutory retention obligations prevent deletion.

16. Web analytics with Google Analytics

This website uses Google Analytics 4, a web analytics service provided by:

Google Ireland Limited Gordon House Barrow Street Dublin 4 Ireland

Google Analytics enables us to statistically analyse the behaviour of visitors to our website and to continuously improve our online offering. Google Analytics uses cookies and comparable technologies through which information about your use of the website may be processed.

This may include in particular:

• truncated IP address;

• pages accessed;

• time spent on the website;

• technical information about the browser and end device;

• origin of the visit;

• interactions with the website.

IP anonymisation is enabled. As a result, your IP address is generally truncated within the European Union or the European Economic Area before any further processing. Processing is carried out exclusively on the basis of your express consent pursuant to Article 6(1)(a) GDPR.

Without your consent, no analysis of your usage behaviour takes place. Google may transfer personal data to servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Where personal data is transferred to the United States, such transfer is based on the adequacy decision of the European Commission.

Further information can be found at: https://policies.google.com/privacy and https://business.safety.google/privacy/

You may withdraw your consent at any time with effect for the future via the cookie settings.

17. Social Media

We maintain public business profiles on social networks. Our website contains only links to our profiles on social networks. Simply visiting our website does not result in any personal data being transmitted to Facebook or Instagram.

Only when you click on the relevant link do you leave our website and are redirected to the respective platform. From that point onwards, personal data is processed exclusively by the operator of the respective platform.

Further information can be found in the privacy policies of the respective providers.

Facebook Meta Platforms Ireland Limited

Merrion Road Dublin 4 Ireland

https://www.facebook.com/privacy/policy/

Instagram Meta Platforms Ireland Limited

Merrion Road Dublin 4 Ireland

https://privacycenter.instagram.com/

18. Smoobu booking platform

To manage booking enquiries and provide our online booking system, we use the service provided by:

Smoobu GmbH Pappelallee 78/79 10437 Berlin Germany

If you submit a booking enquiry or make a booking via our website, the personal data required for this purpose is transferred to Smoobu and processed there on our behalf.

This includes in particular:

• name;

• postal address;

• email address;

• telephone number;

• booking period;

• number of guests;

• payment information;

• other information required to process the booking.

• Processing is carried out on the basis of Article 6(1)(b) GDPR for taking pre-contractual measures and performing the rental agreement.

A data processing agreement pursuant to Article 28 GDPR has been concluded with Smoobu.

Further information about data processing can be found at: https://www.smoobu.com/de/datenschutz/

19. Processing of customer and contract data

For the purpose of processing bookings and rental agreements, we process the personal data of our guests.

This includes in particular:

• name;

• postal address;

• email address;

• telephone number;

• booking data;

• payment information;

• invoice data;

• communication data.

Processing is carried out exclusively for the following purposes:

• processing booking enquiries;

• concluding and performing rental agreements;

• payment processing;

• invoicing;

• compliance with legal obligations;

• communication with guests;

• assertion or defence of legal claims.

Processing is based on:

• Article 6(1)(b) GDPR (contract);

• Article 6(1)(c) GDPR (legal obligations);

• and Article 6(1)(f) GDPR (legitimate interests).

Personal data is stored only for as long as is necessary for the performance of the contract and for the duration of statutory retention periods. After the statutory retention periods have expired, the data is deleted unless further storage is necessary for legal reasons.

20. Payment service providers

We offer various payment options for processing payments. Your payment data is processed exclusively for the purpose of carrying out the respective payment transaction and performing the rental agreement concluded with you. The legal basis for processing is Article 6(1)(b) GDPR. Depending on the payment method selected, your payment data is processed directly by the relevant payment service provider.

PayPal

If you choose PayPal as the payment method, payment is processed by:

PayPal (Europe) S.à r.l. et Cie,

S.C.A. 22–24 Boulevard Royal L-2449 Luxembourg

The personal data required to process the payment is then transferred to PayPal.

This includes in particular:

• name;

• invoice amount;

• payment information;

• transaction data;

• where applicable, other data required to process the payment.

Processing is carried out exclusively for the purpose of completing the payment transaction pursuant to Article 6(1)(b) GDPR. PayPal may disclose personal data to companies within the PayPal group or to technical service providers insofar as this is necessary for payment processing or required by law.

Where personal data is transferred to the United States, such transfer is carried out on the basis of the EU-US Data Privacy Framework or other appropriate safeguards pursuant to Article 46 GDPR.

Further information can be found at: https://www.paypal.com/privacy

Bank transfer

If you choose to pay by bank transfer, we process only the personal data necessary to identify and record your payment.

This includes in particular:

• name of the account holder;

• bank details;

• payment amount;

• payment reference;

• booking date.

Processing is carried out on the basis of Article 6(1)(b) GDPR.

21. Google Maps

To display our location and improve user-friendliness, we use the Google Maps mapping service.

The provider is: Google Ireland Limited Gordon House Barrow Street Dublin 4 Ireland

Google Maps is integrated only after you have expressly given your consent via our cookie consent management system. A connection to Google’s servers is established only after you have given your consent.

The following data may be processed in particular:

• IP address;

• location data (where you have authorised access);

• browser information;

• technical device data;

• usage data relating to the map function.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the cookie settings. Google may transfer personal data to servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework (DPF).

Further information can be found at: https://policies.google.com/privacy