Château de Chazeuil
Privacy policy
Version of 2026-10-15 — pending legal review
Translation for information. The French version prevails. Read the French version
1. Who is responsible for your data
The data controller is DOMAINE DU CHATEAU DE CHAZEUIL (trading as “Château de Chazeuil”, also known as “Domaine du Château de Chazeuil”), a single-shareholder simplified joint-stock company (SASU), registered with the RCS of Cusset under number 102 227 691, registered office at Château de Chazeuil, 03150 Varennes-sur-Allier, Allier, France (“we”), publisher of chazeuil.com. Contact for any data question: [email protected]. We have not appointed a data protection officer [to be completed : confirm that it is not mandatory for this activity].
2. What data, why, and on what legal basis
| Situation | Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Online booking | First name, surname, email, phone, country, optional message; accommodation, dates, number of guests; price; language; date terms were accepted; booking number; Stripe payment identifiers (not the card number) | Manage the booking, confirm, write to you, send the calendar file, refund | Performance of a contract (b) |
| Payment | Handled by Stripe on its own page; we receive the payment status and identifiers, never the card number. When a balance remains to be paid, the card used for the deposit is saved by Stripe, not by us, on a Stripe customer record, so that the balance is charged automatically 30 days before arrival, as you agree when booking; we keep only Stripe's reference to that card, use it for nothing else, and have the card removed from that Stripe record once the balance is paid or the booking cancelled. The damage deposit (€500) is never taken online or through Stripe: it is paid on arrival, by card, cash or cheque, and returned within 7 days of departure at the latest | Charge the deposit and the balance of the stay, remind you 7 days before that charge, refund | Performance of a contract (b); Stripe also acts for its own obligations (fraud prevention) |
| Enquiry | Name, email, optional phone, dates, group size, message | Reply | Pre-contractual steps (b) |
| Chat assistant | Your messages; the page you are on; language; your IP address (rate limiting) | Answer your questions; protect the assistant from abuse | Legitimate interest (f): answering visitors and securing the service |
| Site and form security | IP address, browser technical fingerprint sent to the anti-bot check, request counters | Prevent abuse and bots | Legitimate interest (f) |
| Audience measurement | Page views, referrer, country, device type, in aggregate, without cookies | Understand how the site is used | Legitimate interest (f) |
| Legal obligations | Invoicing and booking data; tourist tax; police form where applicable (filled in on arrival, off the site) | Accounting, tax, mandatory declarations | Legal obligation (c) |
| Disputes | Booking file and correspondence | Establish, exercise or defend rights | Legitimate interest (f) |
We send no advertising; the newsletter and the e-mails after a stay are described in section 13. We do not sell or rent your data. We carry out no profiling and no automated decision with legal effect on you: the chat assistant answers questions, it decides nothing about your booking.
Data marked as required on the booking form is mandatory to conclude the contract; without it we cannot process the booking.
3. The chat assistant and artificial intelligence
- The assistant is an automated program, not a person; it tells you so when it opens. You can write to a human by email or WhatsApp at any time.
- It answers first with pre-written answers, in your browser. Only if no pre-written answer fits, your latest messages are sent to our server and then to Anthropic (the Claude AI service) to draft a reply. Avoid typing personal or sensitive information into the chat.
- We do not keep the content of your conversations on our servers. To improve the assistant we keep only a non-reversible fingerprint of unanswered questions, with the language and a counter, for 90 days.
- Anthropic acts as a processor. According to its documentation it generally deletes API inputs and outputs within 30 days, with exceptions [to be completed : check the applicable Anthropic agreement]. This data is not used to train its models without permission.
- The chat transcript stays in your browser (session storage) until you close the tab.
4. Recipients and processors
| Recipient | Role | For what | Country |
|---|---|---|---|
| Cloudflare, Inc. | Processor (hosting); for the anti-bot check, also controller for improving its service (article 6) | Site hosting, booking storage (Cloudflare D1 database), anti-bot check (Turnstile), audience measurement (Web Analytics) | USA, global infrastructure |
| Stripe Payments Europe, Limited (Dublin) | Payment provider; controller for its own obligations | Online payment, refunds, fraud prevention | Ireland; transfers to the USA |
| Resend, Inc. | Processor | Sending confirmation emails | USA [to be completed : check] |
| Anthropic, PBC | Processor | Assistant replies as a last resort | USA |
| Google Ireland Limited (Google Workspace) | Processor | Mailbox: receiving your emails | EU, transfers possible [to be completed : check] |
| Booking.com B.V. | Separate controller | If you book on Booking.com, its policy applies; we receive the information needed for your stay. The calendars we exchange with Booking.com contain no personal data (closed dates only) | Netherlands |
| Accountant [to be completed : accountancy firm name, if any]; local authority (tourist tax); authorities on legal request | Recipients | Legal obligations | France |
Third-party content: the Site's images are served by the Site itself. The interactive estate map loads its map tiles and aerial photographs from the IGN (data.geopf.fr, France), which then sees your IP address.
5. Transfers outside the European Union
Several providers are established in the United States. Transfers are covered as follows:
- Cloudflare: EU-US Data Privacy Framework (DPF) certification and, failing that, standard contractual clauses (SCCs) built into its processing agreement.
- Stripe: US entity certified under the DPF according to Stripe; SCCs in addition.
- Anthropic: [to be completed : SCCs in the processing agreement? DPF certification?]
- Resend: [to be completed : SCCs? DPF certification?]
- Google: [to be completed : to check]
An adequacy decision (the DPF) can be challenged; an appeal is pending before the Court of Justice of the European Union (case C-703/25 P). In that case SCCs are the fallback safeguard. You may obtain a copy of the safeguards by writing to us.
6. Why Cloudflare is sometimes a controller
For the anti-bot check (Turnstile), Cloudflare states that it acts as a processor for bot detection and as a controller for improving the check. We mention it for transparency. See the Cookie Policy for the choice you have.
7. Retention periods
| Data | Period |
|---|---|
| Booking data (our booking file) | 3 years after the end of the contractual relationship |
| Billing data | 10 years from the close of the financial year |
| Data needed to handle a dispute | The applicable limitation period |
| Dates held while you pay | 1 hour |
| Booking abandoned before payment | Your details are erased after 2 days |
| Paid booking in the site's booking store (Cloudflare D1) | Your details: until the estate's booking system has imported them, and 30 days after payment at the latest; the stay's dates and amounts: [to be completed : retention period to confirm] |
| Minimal archive of a paid booking (identity, dates, amounts, payment), restricted access | 10 years (retention of electronic contracts and accounting duties), in the estate's booking system (Lodge OS), on the Owner's computer [À VALIDER — avocat] |
| Enquiries with no follow-up, and every record of the guest file (section 13) | 3 years after the last interaction, then anonymised (CNIL guidance for prospects); an unconfirmed newsletter request: 30 days |
| Clefs de Chazeuil account (section 12) | Deleted after 3 years without signing in |
| Card saved by Stripe for the balance (kept at Stripe, never on our servers) | Until the balance is paid or the booking is cancelled; the card is then removed (detached) from the Stripe customer record, at the latest the next day, and can no longer be charged. For a stay paid in full when booking, no card is saved. Stripe keeps its own records under its own legal obligations |
| Rate-limit counter (IP address or its fingerprint) | 1 hour |
| Fingerprints of the assistant's unresolved questions | 90 days |
| Content of conversations with the assistant | Not kept by us; at Anthropic, generally up to 30 days |
| Police form (where applicable) | 6 months |
| Emails exchanged with us | [to be completed : 3 years after the last exchange, proposed] |
| Technical logs of the host and email provider | Per the providers [to be completed : check] |
8. Your rights
You may ask for access to your data, rectification, erasure (except where the law requires us to keep it), restriction of processing, portability of the data you gave us, and you may object to processing based on our legitimate interest. You may set instructions for your data after your death.
How: write to [email protected] with your name, your booking email and the booking number. We reply within one month (extendable by two months for a complex request). We may ask for reasonable proof of identity.
Complaint: you may contact the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
9. Security
Encrypted connection (HTTPS); no card number passes through our servers; signed payment notifications; administration access protected by a secret; booking data under restricted access. The emails we send contain no tracking pixel [to be completed : switch off open and click tracking at Resend].
10. Minors
The site is aimed at adults. Bookings are made by adults. The assistant is not intended for minors. Photographs of children are published with the written consent of their legal guardians.
11. Changes
We update this policy if our processing changes; the date at the top prevails. Publisher: DOMAINE DU CHATEAU DE CHAZEUIL, Château de Chazeuil, 03150 Varennes-sur-Allier, Allier, France.
12. Clefs de Chazeuil, the guests' programme
Clefs de Chazeuil counts the nights you book directly with us. Joining is optional: you join only by ticking an unticked box when you book, and booking works the same without it.
| Data | Purpose | Legal basis |
|---|---|---|
| A membership number; your first name; a coded form of your e-mail address (a keyed one-way code, from which the address cannot be read back: the address itself is not kept in the programme); the dates you joined and last signed in | Recognise you as a member and let you sign in | Consent (a), given by ticking the box |
| The link between your membership and your paid direct stays (dates, house, number of nights) | Count your points: one point per paid night booked directly | Consent (a) |
| Sign-in links and the session cookie `clefs_session`: only a one-way code of each is kept; a link works once, for 15 minutes; a session lasts 30 days when you sign in to Clefs de Chazeuil, 8 hours when it is opened by a My Chazeuil sign-in (section 14) | Sign you in without a password | Consent (a); the cookie is strictly necessary to the member area you asked for |
- Where: in the site's booking store (Cloudflare D1, section 4). The sign-in e-mail is sent through Resend (section 4).
- How long: links are erased after one day, sessions when they expire, and a membership not signed into for 3 years is deleted.
- Your choice: on the Clefs page you can sign out, sign out on every device, or delete your account, which withdraws your consent. Deleting it removes your membership and its links to your stays; the booking records themselves follow the retention periods of section 7. Withdrawing consent does not affect any booking.
13. Our guest file, the newsletter and the e-mails after a stay
We keep one record per e-mail address (the "guest file") for guests who booked on this site, members of Clefs de Chazeuil, newsletter subscribers and people who wrote to us through the enquiry forms. It is separate from the booking itself: the guest details on a booking are still erased as section 7 says.
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail address, first name, surname, country, language; where you first came from (booking, newsletter, enquiry); a label of what you are (guest, member, subscriber, enquirer, group or celebration enquiry) | Know who we are writing to, in your language; answer you; keep one record per person | Performance of a contract or pre-contractual steps (b) for guests and enquirers; consent (a) for subscribers |
| Your site bookings (link to the booking, first and last stay, number of stays) | Show your stays in My Chazeuil; time the e-mails below | Performance of a contract (b) |
| Newsletter: status (asked, confirmed, unsubscribed), the date and time of each step, the form you used, a keyed one-way code of the IP address that asked (not the address itself) | Send the newsletter only to those who confirmed it, and prove that consent | Consent (a), given by an unticked box and confirmed by a link sent to your address (double opt-in) |
| Birthday: month and day only (never the year) | Send a birthday greeting | Consent (a), a separate unticked box in My Chazeuil |
| The automated e-mails already sent to you (which one, when) | Never send the same e-mail twice | Legitimate interest (f) |
The e-mails we send automatically:
- before your stay (about 7 days before arrival): practical information (times, address, damage deposit, contact). It is part of your booking (b).
- after your stay (the day after departure): a thank-you, an invitation to leave a review on Google, and information about Clefs de Chazeuil; then a year later, a note inviting you back. As a guest you receive these under the rules that allow a business to write to its own customers about similar services, unless you have said no; you can refuse them when booking by writing to us, and in one click in every one of these e-mails [to be completed : [À VALIDER — avocat] soft opt-in under art. L34-5 CPCE for a booking made directly].
- the newsletter, a few letters a year, only if you subscribed and confirmed. The seasonal letters are written by the owners in Brevo.
- a birthday greeting, only if you gave the day and month and ticked the box.
Unsubscribing: every one of these e-mails (except the one before your stay, which is part of your booking) carries an "Unsubscribe in one click" link and the standard one-click unsubscribe header that mail programs show, and a link to your preferences. Unsubscribing stops the newsletter and every e-mail after a stay and the birthday greeting at once; e-mails about a booking continue.
Brevo (Sendinblue SAS, France; servers in the European Union) is our processor for the newsletter: only confirmed subscribers are sent to it (address, name, language, country, Clefs tier and points, last stay), and removed from it when they unsubscribe or ask for erasure. Until it is set up, nothing leaves our booking store (Cloudflare D1, section 4). E-mails are sent through Resend (section 4).
How long: a record is anonymised 3 years after your last interaction with us (last stay, last booking, last message or sign-in, last change of preferences), in line with the CNIL's guidance for prospects; a newsletter request that was never confirmed is erased after 30 days. The legal retention of booking records (section 7) is not shortened by this.
14. My Chazeuil, your area on the site
My Chazeuil (/account) shows your stays booked on this site, their balance, your Clefs de Chazeuil points and benefits, and your preferences. You sign in with a one-time link sent to your e-mail address (it works once, for 15 minutes; only a one-way code of it is kept), with no password. You stay signed in through the cookie `chz_account` (HttpOnly, Secure), which lasts 8 hours or until you sign out; for a Clefs member, the cookie `clefs_session` is set for the same 8 hours (a sign-in to Clefs de Chazeuil itself lasts 30 days, see section 12). Both are strictly necessary for the area you asked for (see the Cookie policy).
In My Chazeuil you can, at any time:
- change your preferences (newsletter, e-mails after a stay, language, birthday);
- download a copy of your data (right of access and portability, GDPR art. 15 and 20), as a file;
- ask for your data to be deleted (art. 17): we e-mail you a confirmation link; once you open it, your record in the guest file is anonymised, your Clefs de Chazeuil account is deleted, you are removed from Brevo, and the owners are told so that they can delete what is no longer needed elsewhere. Booking records the law requires us to keep (section 7) are kept for that period only.
You keep every right of section 8, including the right to object to the e-mails after a stay and to withdraw a consent at any time, without affecting what was done before.
15. Video surveillance on the estate
The estate is equipped with a video-protection system to keep people safe and protect property. It covers the entrances to the estate, some outdoor areas and the surroundings of the buildings; cameras are never installed inside the private spaces of the accommodation.
- Purposes: to prevent and detect offences, to protect the health and safety of guests, visitors and the estate's employees, and to keep property secure. Every camera is positioned so that it films only the areas that must be monitored for these purposes.
- Legal basis: the estate's legitimate interest in keeping the premises, guests, visitors and employees safe (GDPR art. 6(1)(f)).
- Retention: recorded images are kept for 30 days from their recording.
- Sound: only images are recorded; the system does not capture sound.
- Recipients: the estate's authorised staff, the authorised staff of its processors and, where applicable, the competent authorities.
You have the rights of section 8 over these images.