Privacy Policy
SARL VILLA SAINT LAGER is committed to protecting the privacy of visitors and users of its website. This policy describes what data is collected, why, how it is processed and what your rights are, in accordance with the General Data Protection Regulation (GDPR — EU 2016/679).
1. Data Controller
SARL VILLA SAINT LAGER
341 Route du Pavé, 69220 Saint-Lager, France
SIREN: 411 377 856 — SIRET: 411 377 856 00025
Email: contact@villasaintlager.fr
Phone: +33 6 89 34 10 39
2. Data Collected and Purposes
2.1 Contact Form
Data: first name, last name, email address, phone (optional), subject, message.
Purpose: responding to your enquiry.
Legal basis: legitimate interest (Art. 6.1.f GDPR).
Retention period: 3 years from the last exchange.
2.2 Newsletter
Data: email address, first name (optional), language, registration source, consent date.
Purpose: sending communications about the Villa, seasons and offers.
Legal basis: consent (Art. 6.1.a GDPR).
Retention period: until withdrawal of consent (unsubscription).
You may unsubscribe at any time by contacting us at contact@villasaintlager.fr.
2.3 Member Area
Data: email address, first name, last name, preferred language, communication preferences,
account creation timestamp.
Purpose: access to the member area reserved for guests (dashboard, exclusive offers).
Legal basis: performance of a contract / legitimate interest.
Retention period: duration of the client relationship + 3 years.
2.4 Booking (Smoobu / Stripe)
Bookings and deposit payments are processed by our service providers Smoobu (hotel management software) and Stripe (online payment). These providers collect data necessary for the transaction (name, email, amount, payment details). We do not store your banking data.
2.5 Cookies and Analytics
Subject to your consent, this site uses:
- Google Analytics 4 (Google LLC, USA) — anonymised audience measurement (page views, traffic sources). IP anonymised. Retention: 14 months. Google Privacy Policy.
- Microsoft Clarity (Microsoft Corporation, USA) — session recordings and heat maps to improve the experience. Retention: 13 months. Microsoft Privacy Statement.
These tools are only loaded after your explicit consent. You can change your choice at any time via the link at the bottom of the page.
3. Sub-processors and Transfers Outside the EU
| Service | Role | Country | Safeguards |
|---|---|---|---|
| Vercel Inc. | Website hosting | USA | DPA + Standard Contractual Clauses (SCC) |
| Supabase Inc. | Database (members, newsletter, events) | EU / USA | DPA + SCC — data stored in EU (AWS eu-west-3) |
| Resend Inc. | Transactional email sending | USA | DPA + SCC |
| Smoobu GmbH | Booking management | Germany (EU) | Within the EU — GDPR applicable |
| Stripe Inc. | Online payment (deposits) | USA / EU | DPA + SCC |
| Google LLC | Analytics 4 (with consent) | USA | DPA + SCC |
| Microsoft Corporation | Clarity (with consent) | USA | DPA + SCC |
4. Your Rights (GDPR)
Under the GDPR, you have the following rights:
- Right of access: find out what data we hold about you.
- Right to rectification: correct inaccurate or incomplete data.
- Right to erasure: request deletion of your data.
- Right to data portability: receive your data in a structured format.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: unsubscribe from the newsletter or refuse cookies at any time.
- Right to lodge a complaint: with the relevant data protection authority in your country of residence.
To exercise these rights: contact@villasaintlager.fr. We respond within one month.
5. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure: HTTPS encryption (HSTS), access restricted by Supabase RLS rules, role-based access management, rate limiting on sensitive endpoints.
6. Cookies — Details
| Cookie | Service | Duration | Purpose |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4 | 13 months | Anonymised audience measurement |
_clck, _clsk | Microsoft Clarity | 12 months / session | Session recordings, heat maps |
vsl-cookie-consent | This site (localStorage) | Indefinite (until cleared) | Remember your consent choice |
| Supabase auth cookies | Supabase (member area) | Session / 1 year | Maintain authenticated member session |
7. Updates
This policy may be updated at any time. The date of the last modification appears at the bottom of this page. In the event of a material change, we will inform you by email if you are subscribed to our newsletter.
Last updated: June 2026