📄 Privacy Policy
Last updated: July 2026
🔹 Introduction
La Base du Rocher (Cap Kaya) is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).
This policy explains:
• What data we collect.
• How we use it.
• How we protect it.
• Your rights.
🔹 Data Collected
1. Data You Provide Directly
• Contact Form: First name, last name, email, phone, message.
• Newsletter: Email.
• Reservations: First name, last name, email, phone, reservation details (date, route, number of people).
2. Automatically Collected Data
• Cookies: See Cookie Management section.
• Technical Logs:
◦ Anonymized IP address (after 24 hours).
◦ Browser type.
◦ Pages visited.
◦ Time and date of visit.
3. Data from Third Parties
• Google Ads:
◦ Browsing behavior (if consent is given).
◦ Demographic data (age, gender, interests).
• Matomo Analytics (self-hosted):
◦ Audience data (anonymized, GDPR-compliant).
🔹 Use of Data
Purpose: Responding to your inquiries
• Legal Basis: Contractual necessity (Art. 6.1.b GDPR)
• Examples: Replying to an email or call.
Purpose: Sending newsletters
• Legal Basis: Consent (Art. 6.1.a GDPR)
• Examples: Information about our activities.
Purpose: Website improvement
• Legal Basis: Legitimate interest (Art. 6.1.f GDPR)
• Examples: Audience analysis.
Purpose: Targeted advertising
• Legal Basis: Consent (Art. 6.1.a GDPR)
• Examples: Google Ads.
Purpose: Reservation management
• Legal Basis: Contractual necessity (Art. 6.1.b GDPR)
• Examples: Reservation confirmation.
🔹 Data Security
• Encryption: HTTPS (SSL/TLS) across the entire website.
• Storage:
◦ Data hosted in France (OVH).
◦ Access restricted to authorized personnel (employees, processors).
• Protection Against Intrusions:
◦ Firewall.
◦ Regular CMS updates (SPIP).
◦ Daily backups.
🔹 Data Transfers Outside the EU
• Google LLC (United States):
◦ Protection Mechanism: Standard Contractual Clauses (SCCs) validated by the European Commission.
◦ Data Concerned: Cookies (Google Ads), anonymized IP addresses.
◦ Link to SCCs: Google Privacy Framework
🔹 Data Retention
Data Type: Contact data
• Duration: 1 year after last interaction
• Legal Basis: GDPR, Art. 5.1.e
Data Type: Reservation data
• Duration: 3 years after reservation
• Legal Basis: Legal obligation (accounting)
Data Type: Advertising cookies
• Duration: 13 months
• Legal Basis: CNIL recommendation
Data Type: Technical logs
• Duration: 24 hours (IP anonymized afterward)
• Legal Basis: Legitimate interest
🔹 User Rights
You have the following rights regarding your personal data:
1. Right of Access: Obtain a copy of your data.
2. Right to Rectification: Correct or complete your data.
3. Right to Erasure ("Right to Be Forgotten"): Delete your data (subject to conditions).
4. Right to Restriction of Processing: Suspend the use of your data.
5. Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV).
6. Right to Object: Refuse the processing of your data (e.g., marketing).
7. Right to Withdraw Consent: At any time (e.g., cookies, newsletter).
8. Right to Object to Profiling: Refuse automated decisions (e.g., targeted advertising).
How to Exercise Your Rights:
• Free of charge (except for excessive or repetitive requests).
• Response time: Within 1 month (extended to 2 months in case of complexity).
• Identity verification: A copy of your ID (front side only) may be requested.
🔹 Changes to This Policy
• Last updated: July 2026.
• Notification: Changes will be posted on the website and, if necessary, notified by email.
• History: Previous versions are archived and available upon request.
