Privacy Policy

The controller responsible for processing data collected on the site is:

• Sébastien Pierrejean, site publisher, private individual
• Contact: souslesetoiles974@gmail.com

As there is no commercial activity exceeding the regulatory thresholds, no Data Protection Officer (DPO) has been appointed. The publisher handles requests relating to personal data directly, at the email address above.

The site may collect the following categories of data:

• Identification and contact data (first name, last name, email address, message) when you write to me directly by email or via a contact form.
• Newsletter sign-up data (email address, date and proof of consent, sign-up source) when you sign up via the “free ebook” form to receive the newsletter.
• Browsing and technical data (truncated IP address, device and browser type, pages viewed, time spent, traffic source) collected automatically for anonymised audience measurement and security purposes.
• Consent data (choices made via the cookie banner) stored locally in your browser to respect your preference on each visit.

No payment data is collected on the site. Bookings are completed entirely on partner platforms (see the how a booking works page for details of the process).

The data collected is used to:

• Respond to your requests (email, partnership enquiry, error report), legal basis: performance of pre-contractual measures or the publisher's legitimate interest in responding to requests received.
• Send you the newsletter (travel tips, deals and access to the ebook), legal basis: consent from the subscriber, collected via an unchecked tick box and revocable at any time.
• Measure audience and improve the site (most-read pages, traffic sources), legal basis: consentfrom the user when cookies that aren't strictly necessary are set.
• Ensure the security of the site (detecting abuse, protecting against spam), legal basis: legitimate interest.
• Respect your cookie preferences, legal basis: legal obligation (Article 82 of the French Data Protection Act and Article 6 of the GDPR).

No profiling or automated decision-making with legal effects on the data subject is carried out.

The data collected is intended solely for the site's publisher and, where applicable, the technical processors strictly necessary for the service to function:

• Vercel Inc. (hosting provider, United States), for hosting and serving the site.
• Google LLC (United States), for anonymised audience measurement if you've accepted analytics cookies.
• Meta Platforms Ireland Ltd (Ireland), for advertising measurement (Meta pixel) if you've accepted advertising cookies.
• Cloudinary (United States), for serving images.
• Supabase, for the secure storage of newsletter sign-ups in a database.

Your data is never sold, rented out or exchanged with third parties for commercial purposes.

As the site is hosted by Vercel Inc. in the United States, some technical data (IP address, request headers) may pass through or be processed outside the European Union. Vercel adheres to the EU-US Data Privacy Framework (DPF), a mechanism recognised by the European Commission's adequacy decision of 10 July 2023, offering a level of protection equivalent to that provided by the GDPR.

Any transfers to the other technical processors (Google, Meta, Cloudinary, Supabase) are covered either by the DPF or by standard contractual clauses approved by the European Commission.

• Emails received (contact or partnership requests): 3 years from the last exchange, unless you object sooner.
• Newsletter subscribers (email address): until you unsubscribe, then deleted within a reasonable time. If there's no interaction for a long period, the subscription is reviewed after 3 years.
• Audience measurement data (analytics cookies): 13 months maximum, in line with CNIL's recommendation.
• Cookie preferences (consent or refusal): 6 months, after which the banner reappears to confirm your choice.
• Server logs (security): 12 months maximum.

A cookie is a small file placed on your browser to remember information (a preference, a session ID, a visit measurement). The site uses several categories of cookies:

You can change your preferences at any time via the cookie banner, which automatically reappears every 6 months.

The publisher implements reasonable technical and organisational measures to protect data against unauthorised access, disclosure, alteration or destruction. The site is served exclusively over HTTPS, admin access is protected by authentication, and processors are selected based on security criteria.

Under the GDPR, you have the following rights:

• the right to access your data,
• the right to rectify inaccurate data,
• the right to erasure (the right to be forgotten),
• the right to restrict processing,
• the right to data portability,
• the right to object on legitimate grounds,
• the right to withdraw your consent at any time,
• the right to lodge a complaint with the CNIL, the French data protection authority (cnil.fr/fr/plaintes).

To exercise these rights, send an email to souslesetoiles974@gmail.com specifying your request. Proof of identity may be requested if there's reasonable doubt about the requester's identity. A response is provided within one month at the latest from receipt of the request.

This policy may be updated to reflect technical, regulatory or organisational changes. The update date appears at the top of the page. In the event of a substantial change affecting your rights, the publisher will inform affected users.