• PURPOSE

The purpose of this policy is to inform you about how we use the personal data you provide when using the website www.chateaudecandie.com, as well as the measures we have put in place to protect it.

• SCOPE

The data controller is EUROGROUP, a simplified joint stock company with a capital of €2,100,000, whose registered office is located at 472 Rue de la Leysse, 73000 CHAMBERY, registered in the Chambéry Trade and Companies Register under number 383 109 873, acting through its subsidiary Société Nouvelle Château de Candie, a simplified joint stock company with a capital of €10,000, whose registered office is located at 472 Rue de la Leysse, 73000 CHAMBERY, Registered in the Chambéry Trade and Companies Register under number 800 634 032 and under the MADAME VACANCES brand.

Contact details for the data protection officer: Coralie Bertojo [email protected]

Hypertext links to other websites contained on our website are not governed by our charter. We therefore invite you to find out about the rules applicable to the personal information you may disclose, as we cannot be held liable in any way for any malpractice on the part of these websites in terms of data protection.

• PERSONAL DATA – DEFINITION

Personal data refers to any information that directly or indirectly identifies you as a natural person and that you have voluntarily provided to us when using our website, including, but not limited to, your surname, first name, email address, date of birth, town of residence, etc.

For information purposes, your consent applies to the areas listed in the cookie policy on our website.

• PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA

As provided for in Article 5 of the General Data Protection Regulation:

1. Personal data must be:

a) processed lawfully, fairly and transparently in relation to the data subject (lawfulness, fairness, transparency);

b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes (purpose limitation);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (accuracy);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (storage limitation);

(f) processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality);

• The controller is responsible for compliance with paragraph 1 and is able to demonstrate that it is complied with (accountability).

• PURPOSE OF PROCESSING

The personal data mentioned above is collected for the following purposes, among others:

• To enable your authentication in order to access your Customer Area
• To send you newsletters or any other documentation useful in connection with your booking (e.g. vouchers, invoices, etc.)
• To send you, with your express prior consent, commercial offers and promotional emails about our holidays
• To enable you to participate in games and competitions
• To be transmitted to our commercial partners in the context of booking their services through our website, without any promotional purpose
• To carry out studies and research with the aim of improving our services

The Axeptio tool, which allows you to manage your cookies via a banner available when you open the website page in a private browsing tab, lists all active cookies and indicates the purposes for which your data is processed.

• DATA RETENTION PERIOD

In the context of communication, data retention may not exceed 36 months.

Cookies are stored for a maximum of 12 months.

For more information, please consult Axeptio, which indicates the maximum storage period associated with each cookie.

• SECURITY OF PERSONAL DATA

We take appropriate technical and organisational measures, in accordance with the applicable legal provisions (in particular Article 32 of the GDPR), to protect your personal data against destruction, loss or alteration, misuse and unauthorised access, modification or disclosure, whether these actions are unlawful or accidental. To this end, we have implemented technical measures (such as firewalls) and organisational measures (such as a username/password system, physical protection measures, etc.) to ensure the ongoing confidentiality, integrity, availability and resilience of our processing systems and services. When you submit your credit card details during the booking process, SSL (Secure Socket Layer) encryption technology is used to secure your transactions. Organisational measures ensure the security of the processing.

• COOKIES AND OTHER TRACKERS

A cookie is a text file placed in a dedicated area of your device’s hard drive (computer, tablet, mobile phone or any device optimised for the internet) when you view online content. This cookie file can only be read by its issuer. The cookie does not identify you personally, but only your device’s browser.

Château de Candie uses cookies and other trackers on its website. Cookies enable us to understand how you use our site and to present you with personalised information tailored to your needs, thereby facilitating and optimising your browsing experience.

When you first visit our website, you will be notified by a banner in the middle of your screen that information relating to your browsing may be stored, subject to your consent, on your computer (or tablet, smartphone, etc.) in files called ‘cookies’.

In accordance with the recommendations of the CNIL (French Data Protection Authority), certain cookies are exempt from your prior consent insofar as they are strictly necessary for the functioning of our website or have the sole purpose of enabling or facilitating electronic communication. These include, but are not limited to, session identifiers, authentication identifiers, and cookies for personalising your interface.

If you do not wish to use cookies, we invite you to configure your browser settings to approve or refuse cookie storage requests. You can also disable cookies via the Axeptio tool on the Château de Candie website. Simply click on the ‘Use only necessary cookies’ option to disable cookies.

For your information, if you refuse all or some cookies, certain features of our website may be compromised or certain pages may be inaccessible.

Château de Candie and Madame Vacances use different types of cookies:

• Necessary cookies help make a website usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies. Château de Candie and Madame Vacances use the following in particular:
• Axeptio
• Google
• La fourchette/The Fork
• Cookies for statistics help website owners understand how visitors interact with websites by collecting and reporting information anonymously. Château de Candie and Madame Vacances use the following in particular:
• Google.com – Google
• La fourchette/The Fork: widget.thefork.com
• Marketing cookies are used to track visitors across websites. The aim is to display advertisements that are relevant and interesting to the individual user and therefore more valuable to publishers and third-party advertisers. Château de Candie and Madame Vacances use the following in particular:
• Meta Platforms
• Google
• YouTube

Other cookies are also used when browsing the Château de Candie and Madame Vacances websites:

bing.com – Microsoft

bat.bing.com – Microsoft

facebook.com – Facebook

www.facebook.com – Facebook

google.com – Google

google.fr – Google

madamevacances.com

www.madamevacances.com

siteeuwest.slgnt.eu – Selligent

www.tamgrt.com – Selligent

Tripadvisor.com – TripAdvisor

https://www.ubiliz.com – Ubiliz

• YOUR RIGHTS

You are entirely free to manage the collection or use of your personal data.

To do so, when filling out a form, you must indicate your refusal to allow this information to be used for commercial purposes.

If you have already done so and wish to change your mind, you have the right to access, rectify and oppose the processing of your personal data, in accordance with the French Data Protection Act of 6 January 1978.

To exercise this right, please send us an email to [email protected], or a letter to the following address: EUROGROUP 472 Rue de la Leysse 73 000 CHAMBERY, accompanied by proof of your identity, in particular by providing a signed scan of your valid identity document (if contacting us by post).

To help you with this process, you will find a letter template developed by the CNIL (French Data Protection Authority) by clicking on the following link: https://www.cnil.fr/fr/modele/courrier/exercer-son-droit-dacces

• Right of access:

The purpose of this right is to allow you to access your personal information. However, we reserve the right, where applicable, to oppose any request that is clearly abusive due to the number or repetitive or systematic nature of the request.

• Right of rectification:

Under this right, you may request the rectification, updating, locking or deletion of any data concerning you that is inaccurate, erroneous, incomplete or obsolete.

• Right to object:

This right may be exercised if it is based on legitimate grounds or if the aim is to prevent the data from being used for commercial prospecting purposes.

In all cases, we undertake to respond to your request, whatever it may be, within a reasonable period of time, which shall not exceed two months from receipt of your request.

• MODIFICATIONS

This charter may be modified, particularly in the event of changes to the legislation in force.