SAS Presbytery is hereinafter referred to as the "Data Controller". The terms "we", "us" and "our" in this Privacy Policy refer to the Data Controller.

As the person responsible for processing your Personal Data, we do everything in our power to protect your privacy when you visit the Site. This Policy allows you to learn more about the origin and use of your Personal Data and your browsing information processed when you visit our Site. For the purposes of this Policy, the term "Personal Data" refers to any data that relates to you alone and allows you to be identified directly or indirectly, regardless of the Terminal you are using. The term "Terminal" refers to the physical equipment (computer, tablet, smartphone, telephone, etc.) that you use to view and navigate the Site. The term "Regulation" refers to the regulation relating to personal data, and in particular to Regulation No. 2016/679, known as the General Data Protection Regulation, the French Data Protection Act No. 78-17 of 6 January 1978 and the French Act No. 2018-493 on the protection of personal data. By using our Site, you declare that you accept the terms of this Policy in their entirety. If you do not agree with any of these terms, you are free to stop using our Site. This Privacy Policy is updated regularly. We will notify you of any significant changes in advance through notifications on the relevant services or by email as appropriate. The Site will always display the most current version of this Privacy Policy.

In accordance with the Regulations, we list all processing operations in a processing register that we leave at the disposal of the competent authorities. All information you provide during your visits to the Site is confidential. This information is necessary for the purposes of their processing.

The information that may be collected and processed includes:

• Identification data and contact details: first name, last name, postal address, telephone number, email address, language and country from which you interact with us
• Personal data for reservations: check-in and check-out dates, reservation number
• Personal data to fulfill legal obligations: traveller registration, including full name, date & place of birth, nationality, residence address, ID document details, arrival date, and signature (required for non-French citizens under French accommodation law)
• Health data: allergies and dietary needs, where you choose to share them
• Financial and payment data: payment transactions are handled and encrypted by our booking engine and payment provider; we do not store credit card numbers ourselves
• Connection and navigation data: general visit statistics (pages viewed, visit duration) via our website platform's built-in analytics
• Personal preferences: including your language preference

When we ask you to enter personal data to access a feature, some data are mandatory fields since they are required to allow you access to this feature (for example, to register your reservation we need your first and last name). It is important that the personal information shared about you is correct and up to date. We do not process any personal data that could be qualified as "sensitive" (information concerning racial or ethnic origin, political, philosophical or religious opinions, trade union membership, or sex life) within the meaning of the Personal Data Regulations, other than the dietary/allergy information you choose to share with us for your own safety and comfort during your stay. We undertake not to transfer your personal data to third parties unless otherwise specified below in Article 3.3.

• Booking Management — The processing of your data is necessary to keep you informed of your reservation status, provide reservation summaries, accept payments, etc.
• Access to Customer Service — We process your Personal Data as part of our customer service to answer your requests, particularly via email and WhatsApp.
• Fraud Detection and Prevention — We process your personal data to detect, prevent, and investigate fraudulent activities to protect both you and our business from financial crimes, unauthorized transactions, and security threats.
• Improving Our Services — We process general, non-identifying visit statistics (pages viewed, time on site) to understand how our Site is used and to improve it. This is handled through our website platform's built-in analytics — see our Cookies Information page for details.
• Marketing — If you choose to subscribe to updates from us, we process your data to manage that subscription and send relevant information by email according to your preferences. Processing for marketing purposes requires your consent, and you can unsubscribe at any time.

• Contract — For booking management and customer service access. When you make a reservation, we collect and process your personal data to perform the contract between us.
• Legitimate Interest — We process your personal data to ensure the security of our systems, and to detect and prevent fraud, as this can affect you.
• Consent — For marketing communications and any non-essential analytics, where consent is the applicable legal basis.
• Legal Obligation — To comply with applicable legal obligations, such as traveller registration requirements or tax purposes.

In the course of running the guest house, your data may be shared with the service providers we use to operate the business:

• Our booking engine and payment provider, for reservation and payment processing
• Our website platform (Lovable) and its infrastructure partners, for hosting and running this Site
• Competent public authorities, where required by law
• Fraud detection and prevention entities, where relevant

We require third parties who receive your personal data to comply with personal data Regulations. These third parties may only use your personal information according to our instructions and not for their own use. We may also disclose your Personal Data in response to legal authorities' injunctions.

We keep your data for a period determined by applicable French law following your last reservation, to answer questions or complaints, or to meet legal, accounting or analytical requirements. We may also keep your data for research or statistical analysis after anonymisation, in which case no retention period is imposed since it is no longer possible to re-identify you. Any changes to this Policy will be made on this page and notified by email for material changes. If you're subscribed to our newsletter, we'll stop contacting you if you haven't opened our emails for more than twelve months, or sooner if you unsubscribe.

This website is built and hosted on the Lovable platform. Hosting infrastructure is provided by Lovable Labs Incorporated and its infrastructure partners, including Supabase for underlying cloud/database services where used. The Data Controller has implemented appropriate technical measures to maintain the security of your Personal Data.

Your consent must be given clearly and unambiguously. Where we ask for your consent (for example, to send you marketing emails or to set non-essential cookies), you will be informed of the use that will be made of your Personal Data and asked to actively confirm your choice. Under French law, children under 15 years cannot give consent themselves; a parent or guardian's consent is required.

In accordance with the Regulations, you have the following rights over your Personal Data:

• Right of access: Ask if your personal data are being processed and receive a copy of the Personal Data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete Personal Data concerning you
• Right to deletion: Request deletion of your Personal Data where a legal ground applies (e.g. the data is no longer necessary, you've withdrawn consent, or processing was unlawful)
• Right to limit processing: for example while you dispute the accuracy of your data, if you object to deletion during a dispute over unlawful processing but want processing limited instead, or if we no longer need your data but you need it kept for the establishment, exercise or defence of a legal claim
• Right to portability: Request that your Personal Data be provided to you, or transmitted directly to another controller, in a structured, machine-readable format
• Right of objection: Object to processing carried out for our legitimate interests (for reasons relating to your particular situation), or to any commercial prospecting at any time without needing to give a reason
• Right to determine the fate of your Personal Data after your death (e-Testament): specific to French law — you can instruct us on how your data should be handled after your death, including whether it is deleted or transmitted to a relative

Regardless of purpose or legal basis, you can exercise these rights by emailing us at: hello@oldpresbytery.com. Please note that we are not always able to respond positively to your request for legal reasons that we will explain to you. You have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority.

The Site has appropriate security measures to prevent loss, unauthorised use or access, modification or disclosure of your Personal Data. The Data Controller has implemented procedures to manage any violation of personal data.

We recommend connecting only to secure networks, preferably private networks, and being aware of risks involved with public wifi networks. We recommend keeping antivirus and anti-spyware software up to date on your own devices.

We will never solicit you by email to obtain sensitive personal information such as bank details. If you receive a suspicious email claiming to be from us, please do not reply, and forward it to us so we can take action.