The data controller is PRESBYTERY, SAS, trading as Old Presbytery Guest House, 1302 Route du Montet, 33220 Saint-André-et-Appelles, France (hello@oldpresbytery.com), hereinafter the "Data Controller". The terms "we", "us" and "our" in this Policy refer to the Data Controller. No Data Protection Officer has been appointed, as the establishment does not meet the criteria requiring one; any question about this Policy or your data can be sent to hello@oldpresbytery.com.

As the person responsible for processing your Personal Data, we do everything in our power to protect your privacy. This Policy allows you to learn more about the origin and use of your Personal Data and your browsing information. For the purposes of this Policy, the term "Personal Data" refers to any data that relates to you alone and allows you to be identified directly or indirectly, regardless of the Terminal you are using. The term "Terminal" refers to the physical equipment (computer, tablet, smartphone, telephone, etc.) that you use to view and navigate the Site. The term "Regulation" refers to the regulation relating to personal data, and in particular to Regulation No. 2016/679, known as the General Data Protection Regulation, the French Data Protection Act No. 78-17 of 6 January 1978 and the French Act No. 2018-493 on the protection of personal data.

This Policy is updated regularly. The Site will always display the most current version of this Policy.

This Policy is available in English, French and Dutch. Where French law requires it, the French version prevails. The French version is available at https://oldpresbytery.com/fr/privacy-policy.

In accordance with the Regulation, we list all processing operations in a processing register (documentation of processing activities), which we keep at the disposal of the competent authorities. All information you provide to us is treated as confidential and is used only for the purposes described below.

The information that may be collected and processed includes:

• Identification data and contact details: first name, last name, postal address, telephone number, email address, language and country from which you interact with us
• Reservation data: check-in and check-out dates, room, number of guests, reservation number, and the channel you booked through (for example our Site, Booking.com, Airbnb or another booking platform)
• Traveller registration (legal obligation): full name, date and place of birth, nationality, residence address, ID document details, arrival date and signature. This is required for all guests who are not French nationals, including foreign nationals living in France, under Articles R814-1 et seq. of the French Code of Entry and Residence of Foreign Nationals (CESEDA). This information is collected through an online registration form and may be communicated to the police, gendarmerie or customs upon lawful requisition. If a guest who is required to complete this registration refuses to do so, we are entitled to refuse the stay.
• Allergies and dietary requirements: only if you choose to share them, so that we can prepare your meals safely (see 3.3)
• Payment data: card payments are processed by Stripe through our booking engine (Beds24), or by the booking platform you booked with. We do not store full card numbers ourselves.
• Communications: emails, WhatsApp messages and other correspondence you send us
• Newsletter: your name and email address, if you subscribe
• Connection and navigation data: anonymous visit statistics (pages viewed, visit duration, country and device type) from our website platform's built-in analytics, which sets no cookies and stores nothing on your device
• Personal preferences: your language preference

When we ask you to enter personal data to access a feature, some fields are mandatory because they are required to provide that feature (for example, to register your reservation we need your first and last name). It is important that the personal information you share is correct and up to date.

Allergy and dietary information is health data, a special category of personal data under the GDPR. We process it only with your explicit consent and solely to prepare your meals safely. We do not process any other special-category data. We only share your personal data with third parties as described in section 3.4.

• Booking management: to keep you informed of your reservation status, provide reservation summaries and take payment.
• Customer service: to answer your requests, particularly by email and WhatsApp.
• Your stay: to prepare your meals safely where you have shared allergy or dietary information.
• Legal obligations: traveller registration, accounting and tax records.
• Security: to keep our Site and systems secure.
• Improving our services: anonymous visit statistics (pages viewed, time on site) to understand how our Site is used and to improve it. No cookies are used for this; see our Cookies Information page.
• Marketing: if you subscribe to our newsletter, we use HubSpot to send it. This requires your consent, and you can unsubscribe at any time.

• Contract: booking management, your stay and customer service.
• Legal obligation: traveller registration (Articles R814-1 et seq. of the CESEDA), accounting records (Article L123-22 of the French Commercial Code, 10 years) and tax records.
• Explicit consent: allergy and dietary information (GDPR Article 9(2)(a)). You can withdraw your consent at any time.
• Consent: our newsletter.
• Legitimate interest: the security of our Site and systems, and anonymous audience measurement.

Your data is shared only with the service providers we use to run the guest house, each for its specific purpose:

• Beds24: booking engine and channel manager (reservations and guest details)
• Stripe: card payment processing
• Booking platforms (such as Booking.com and Airbnb): if you book through them, they share your booking details with us
• Google: our email (Google Workspace), and the map and fonts shown on our Site
• Online form provider: the traveller registration form
• WhatsApp (Meta): messages, if you contact us that way
• HubSpot: our newsletter, if you subscribe
• Lovable: hosting of this Site and its built-in analytics
• Competent public authorities, where required by law

Our service providers may only use your personal data on our instructions and are bound by data protection terms consistent with the Regulation. These booking platforms act as independent data controllers under their own privacy policies. We may also disclose your Personal Data where required by law.

• Booking and accounting records: 10 years, as required by French accounting law (Article L123-22 of the Commercial Code)
• Traveller registration forms: 6 months, as required by the CESEDA
• Emails and messages: 3 years after your last stay or contact with us, after which they are deleted or anonymised
• Allergy and dietary information: kept with your registration details and deleted at the same time (after 6 months)
• Newsletter: until you unsubscribe
• Anonymous statistics: retained only in aggregate, non-identifying form

This Site is built and hosted on the Lovable platform. Hosting infrastructure is provided by Lovable Labs Incorporated and its infrastructure partners. The Data Controller has implemented appropriate technical measures to maintain the security of your Personal Data.

Some of our service providers (Google, WhatsApp/Meta, HubSpot, Stripe and Lovable) may process data outside the European Union, including in the United States. Where this happens, transfers rely on safeguards approved by the European Commission, such as the EU–US Data Privacy Framework or standard contractual clauses.

Your consent must be given clearly and unambiguously. Where we rely on your consent (our newsletter, and allergy and dietary information), you will be informed of how your Personal Data will be used and asked to actively confirm your choice. You can withdraw your consent at any time. Under French law, children under 15 cannot give consent themselves; a parent or guardian's consent is required.

In accordance with the Regulation, you have the following rights over your Personal Data:

• Right of access: ask whether your personal data is being processed and receive a copy of the Personal Data we hold about you
• Right to rectification: request correction of inaccurate or incomplete Personal Data concerning you
• Right to deletion: request deletion of your Personal Data where a legal ground applies (for example, the data is no longer necessary, you have withdrawn consent, or processing was unlawful)
• Right to limit processing: for example while you dispute the accuracy of your data, if you object to deletion during a dispute over unlawful processing but want processing limited instead, or if we no longer need your data but you need it kept for the establishment, exercise or defence of a legal claim
• Right to portability: request that your Personal Data be provided to you, or transmitted directly to another controller, in a structured, machine-readable format
• Right of objection: object to processing carried out for our legitimate interests (for reasons relating to your particular situation), or to any commercial prospecting at any time without needing to give a reason
• Right to determine the fate of your Personal Data after your death: specific to French law, you can instruct us on how your data should be handled after your death, including whether it is deleted or transmitted to a relative

Regardless of purpose or legal basis, you can exercise these rights by emailing us at hello@oldpresbytery.com. To protect your data, we may ask you to confirm your identity before acting on your request. We will respond within one month of receiving your request; this period may be extended by two further months for complex or numerous requests, in which case we will inform you. Please note that we are not always able to respond positively to your request for legal reasons that we will explain to you. You have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority (www.cnil.fr).

We do not carry out any automated decision-making or profiling that produces legal effects concerning you.

The Site has appropriate security measures to prevent loss, unauthorised use or access, modification or disclosure of your Personal Data. The Data Controller has implemented procedures to manage any breach of personal data, including notifying the CNIL and affected persons where required.

We recommend connecting only to secure networks, preferably private networks, and being aware of the risks involved with public wifi networks. We recommend keeping antivirus and anti-spyware software up to date on your own devices.

We will never ask you for your card details by email, phone or message. Card payments are only ever made through our secure booking engine (Stripe), through the booking platform you booked with, or in person by card at check-out. If you receive a suspicious message claiming to be from us, please do not reply, and forward it to us so we can take action.