This page explains which personal data Tataouine Les Bains collects, why, how long they are kept and how to exercise your rights. This English text is a courtesy translation; in case of discrepancy, the French version prevails.
[À COMPLÉTER: draft to be read over by the manager. The retention periods announced commit the establishment: they must match what is actually applied.]
1. Data controller
The data controller is Les Bains Du Huit, SIRET 91382551900014, operating Tataouine Les Bains, 8 quai de la Fontaine, 30000 Nîmes, France. Contact: tataouinelesbains30@gmail.com — 04 11 83 29 82.
2. The data we collect
Client record:
first name, last name, phone, email, date of birth, language, internal notes taken at the front desk, consent to offers and its date.
Appointments:
treatment, date, duration, amount, means of payment, arrhes paid, discounts applied.
Gift cards:
name of the beneficiary, name of the buyer, message, email of the buyer, reference and movements of the card.
Loyalty:
points earned and redeemed, current subscription.
Emails:
the sendings and their date; the content of the messages is not kept.
Online payments:
the identifier of the order at PayPal and its amount. No banking data is received nor kept by the establishment.
Audience measurement:
the number of pages viewed and of clicks on the phone number, with no cookie, no IP address and no visitor identifier: these counters cannot recognise anyone.
3. Why, and on what basis
Booking and honouring an appointment, selling a gift card, taking arrhes:
performance of the contract (article 6.1.b GDPR).
Keeping the client file and the loyalty programme:
performance of the contract, and the legitimate interest of the establishment in following its clients.
Sending offers, the birthday code and reminders:
your consent (article 6.1.a), given at the front desk, on the sign-up form or in your client area, and withdrawable at any time.
Sending service emails
(gift card, appointment confirmation and reminder, payment link, sign-in link): performance of the contract. They are sent even without consent to offers.
Keeping the accounts:
legal obligation (article 6.1.c).
Keeping the site and the management area secure
(log of sign-ins and of the actions on gift cards): legitimate interest.
4. How long
Client record:
during the commercial relationship, then three years after the last visit or the last contact, unless you ask for it to be deleted.
Consent to offers:
kept with its date and its source while it is valid, then three years as proof.
Gift cards and credit notes:
until they are used or expire, then with the accounting records.
Accounting records
(payments, takings, arrhes): ten years, as article L123-22 of the French commercial code requires.
Links of the client area:
one hour to activate an account created on the site or to choose a new password, fifteen minutes to sign in from the front desk. An account never activated is erased the day after its link expires.
Open sessions:
thirty days.
Password:
until the account is deleted, in a hashed form from which it cannot be recovered.
Log of emails sent:
three years.
Page view counters:
kept in aggregate form, with no personal data.
5. Who receives your data
Your data are handled by the establishment and by its processors, only for what is entrusted to them:
o2switch
(Clermont-Ferrand, France): hosting of the site and of the database, on servers located in France.
Brevo
(Paris, France): sending of the emails.
PayPal (Europe) S.à r.l. et Cie, S.C.A.
(Luxembourg): online payment. PayPal is the controller of the payment data it collects, under its own privacy policy.
No data is sold, rented or passed to third parties for advertising.
6. Transfers outside the European Union
Hosting and email sending take place within the European Union. PayPal may process data outside the Union for its own processing, under the safeguards provided by the GDPR.
7. Your rights
You have a right of access, rectification, erasure, restriction, objection and portability over your data, and the right to withdraw your consent to offers at any time.
Access and erasure:
the "Your personal data" page of the site sends you a sign-in link; your client area lets you download all your data and delete your account.
Unsubscribing from offers:
the "Unsubscribe" link at the bottom of every offer email, or the box in your preferences.
Other requests:
write to tataouinelesbains30@gmail.com or to 8 quai de la Fontaine, 30000 Nîmes. We answer within one month.
You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr.
Deleting an account erases your identity from our files. Accounting records and gift cards already issued are kept without your name, for as long as the law requires.
8. Cookies and trackers
This site sets no advertising cookie and uses no third-party measurement tool. The only cookies used are necessary to its working: they keep your session while you fill in a form or open your client area, and protect the forms against fraudulent sendings. Those cookies are exempt from consent; no banner is therefore shown.
Typefaces, images and scripts are served by this site: no call is made to a third party without your knowledge. The map and the payment open on the sites of Google Maps and PayPal, which then apply their own rules.
9. Security
Exchanges with the site are encrypted (HTTPS). The management area is protected by a password and two-factor authentication, and sensitive actions are logged there. The client area opens with your email address and the password you chose; it is never stored in clear, only in a hashed form from which it cannot be recovered. An account created on the site only opens after the link sent to your address, which confirms it; no record is created or completed before. A single-use link also lets you choose a new password.
10. Contacting us
For any question about this policy: tataouinelesbains30@gmail.com — 04 11 83 29 82 — 8 quai de la Fontaine, 30000 Nîmes.