This policy explains how personal data is collected and processed when you use the Villa Sognu di Mare website, the contact forms and the online booking service.
1. Data controller
The data controller is:
Christian Déprez
Villa Sognu di Mare
1685, strada di Tarcu
Email: booking@sognu-di-mare.fr
2. Data collected
Depending on the services you use, the following data may be collected:
- first and last name;
- email address and telephone number;
- postal address and billing information;
- dates of stay and number of guests;
- information needed to organise your stay;
- the content of enquiries submitted through the contact form;
- information about your booking, selected options and payment;
- technical data needed to operate and secure the website, such as your IP address, browser and connection logs.
The owner does not hold full card details. They are processed directly by Stripe, the secure payment provider.
3. Purposes and legal bases
The data is used to:
- respond to enquiries and take pre-contractual steps;
- check availability and establish the price of the stay;
- record, confirm and manage bookings;
- collect the deposit, the balance and payment for any additional services;
- prepare for your arrival and communicate with guests before, during and after their stay;
- prepare contracts, supporting records and accounting documents;
- comply with the legal, tax and administrative obligations that apply to furnished rentals and the tourist tax;
- secure the website and prevent misuse or fraud;
- manage any disputes.
Depending on the circumstances, these activities are based on taking pre-contractual steps or performing the rental agreement, complying with a legal obligation, the owner’s legitimate interest in managing and securing the business, or consent where required.
4. Required information
Information marked as required is needed to respond to an enquiry or process a booking. Without it, it may be impossible to complete the enquiry or booking.
5. Recipients and service providers
The data is accessible to the owner and, to the extent necessary for their work, to providers involved in operating the website and managing bookings, including:
- Smoobu, for the booking engine and management of stays;
- Stripe, for secure payment processing;
- OVHcloud, for hosting and related technical services;
- email, maintenance and technical support providers;
- administrative, tax or judicial authorities where required by law.
These providers process data in accordance with their contractual obligations and applicable regulations.
6. Payments
Card payments are secured and processed by Stripe. The owner receives only the information needed to track the payment, such as its amount, status and date.
For more information: https://stripe.com/fr/privacy
7. International transfers
Some technical providers may process data outside the European Economic Area. Where this occurs, the transfer is governed by a mechanism recognised by the GDPR, such as an adequacy decision or standard contractual clauses approved by the European Commission.
8. Retention periods
Data is kept only for as long as needed for the relevant purposes:
- enquiries that do not lead to a booking: up to three years after the last exchange;
- data needed to manage a stay: for the duration of the contractual relationship and then for as long as necessary to establish or defend rights;
- contracts, invoices and accounting records: for the applicable statutory periods, which may be up to ten years;
- payment data: in line with Stripe’s retention periods and the corresponding legal obligations;
- technical data: for as long as needed to keep the website secure and operating properly.
9. Cookies and external content
The website may use cookies that are strictly necessary for its operation and for booking. Other services, including maps, videos and audience measurement tools, may place cookies only where regulations permit it or after consent has been obtained where required.
You can change your cookie preferences at any time using the cookie management tool on the website.
10. Your rights
Under the GDPR, and subject to the conditions set out in the regulations, you may request:
- access to your data;
- rectification of your data;
- erasure of your data;
- restriction of processing;
- portability of the data you have provided;
- the right to object to certain processing;
- withdrawal of your consent at any time where processing is based on it.
You can exercise your rights by writing to:
Proof of identity may be requested only when necessary to verify the identity of the requester.
You may also lodge a complaint with the competent supervisory authority, including the CNIL in France or the data protection authority where you live.
11. Security
Reasonable technical and organisational measures are taken to protect data against loss, unauthorised access, disclosure or alteration.
12. Changes to this policy
This policy may be updated to reflect changes to the website, service providers or regulations.
Last updated: 31 July 2026.