At Château de Barbe, we respect your privacy and are committed to protecting the personal data you provide us. This privacy policy explains which data we collect, why we collect it, and how we use it, as well as the rights you have under the General Data Protection Regulation (GDPR).

1. Data Controller
The data controller for the personal data collected on this site is:

• Company Name: Société Civile Château de Barbe

• Address: Château de Barbe, 33710 Villeneuve

• Email Address: contact@chateaudebarbe.fr

• Phone Number: +33 5 57 64 94 10

2. Personal Data We Process
As part of personal data processing, the data controller collects and processes the following data:

• Name, surname, postal address, email address, and phone number; and

• IP address, unique session ID, and unique user ID.

3. Purpose of Processing
We use personal data for the following purposes:

• Managing your requests and contacts: Responding to your inquiries or processing your orders.

• Enhancing user experience: Analyzing browsing data to optimize website functionality.

• Payment processing: Managing financial transactions for purchases made on our site.

• Marketing: Sending newsletters or promotional offers, provided you have given prior consent.

4. Legal Basis for Processing
The processing of your personal data is based on the following legal grounds:

• Consent: When you agree to receive marketing communications or analytical cookies.

• Contractual performance: For processing your orders or responding to your requests.

• Legitimate interest: To improve the functionality of our website and understand how visitors use it.

5. Recipients of Your Data
The personal data we collect, as well as those collected later, are intended for us as the data controller. We ensure that only authorized individuals have access to these data. Our subcontractors/service providers may also have access to the data for the services we assign to them.
Your personal data may be pooled or shared among all the parent, sister, and subsidiary entities of the data controller for the purposes mentioned in this privacy policy. These operations are carried out based on instruments that comply with applicable regulations to ensure the protection of your rights.

6. Transfer of Your Data
As part of the services we offer, we may transfer your personal data to recipients located in the United States. Each transfer is governed by legal instruments in compliance with applicable regulations.
Transfers to the United States are covered by appropriate safeguards. Standard contractual clauses proposed by the European Commission have been signed for all data transfers mentioned in this paragraph.

7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes mentioned in this policy. The retention period varies depending on the nature of the data:

• Prospecting: 3 years from the last contact from you or, where applicable, from the end of the commercial relationship, plus the applicable statutory periods.

• Client: For contracts concluded, data is retained for the duration of the commercial relationship, plus the applicable statutory periods.

• Cookies: Refer to the cookie policy for specific durations based on the type and function of the cookie.

• Requests through the contact form: Retained for the time needed to process the request, plus the applicable statutory period.

• Newsletter: Until consent is withdrawn or, if not, 3 years from the last contact from you.

The retention periods mentioned above may be extended by the applicable statutory periods.

8. Your Rights

8.1 Exercising Your Rights
You can exercise your rights by emailing us at: contact@chateaudebarbe.fr. To do so, please clearly state your first and last names, as well as the address where you wish to receive the response.
In principle, you may exercise all your rights free of charge. However, with respect to the right of access, a reasonable fee based on administrative costs may be charged for any copies of data you request.
Concerning the right to information, the data controller is not required to respond when you already possess the information you request.
The data controller will inform you if they are unable to comply with your requests.
These rights are not absolute and are subject to various conditions under:

• The applicable local data protection and privacy laws; and

• The laws and regulations applicable to you.

Please note that failure to provide or modify your data may affect the processing of certain requests in the context of fulfilling contractual relationships, and that your request regarding the exercise of your rights will be retained for tracking purposes for 6 years concerning the right of objection and 1 year for other rights.

8.2 Your Right to Information
You acknowledge that this privacy policy informs you of the purposes, legal basis, interests, recipients, or categories of recipients with whom your personal data is shared, and the possibility of transferring data to a third country or international organization.
In addition to this information, and to ensure fair and transparent processing of your data, you confirm that you have received additional information regarding:

• The duration of data retention;

• The existence of the rights you have and how to exercise them.

If we decide to process data for purposes other than those indicated, all relevant information regarding these new purposes will be communicated to you.

8.3 Your Right to Access and Rectify Your Data
By exercising this right, you can confirm whether your personal data is being processed and, if so, access your data along with information regarding:

• The purposes of the processing;

• The categories of personal data concerned;

• The recipients or categories of recipients, particularly those in third countries;

• If possible, the intended retention period or, if not possible, the criteria used to determine this duration;

• The existence of the right to request from the data controller the rectification or erasure of your data, the right to request the restriction of the processing of your data, and the right to object to such processing;

• The right to lodge a complaint with a supervisory authority;

• Information about the source of the data when it is not collected directly from the individuals concerned; and

• The existence of automated decision-making, including profiling, and, in such cases, meaningful information about the logic involved, as well as the significance and expected consequences of this processing for the individuals concerned.

You may request that your personal data be rectified or completed if it is inaccurate, incomplete, equivocal, or outdated.

8.4 Your Right to Erasure of Your Data
You may request the erasure of your personal data when one of the following applies:

• The personal data is no longer necessary for the purposes for which it was collected or processed;

• You withdraw the consent previously given;

• You object to the processing of your personal data when there is no legal basis for such processing;

• The processing of personal data does not comply with applicable laws and regulations; and

• Your personal data was collected when you were a minor.

However, the exercise of this right will not be possible when the retention of your personal data is necessary under legal or regulatory requirements, particularly, for example, for the establishment, exercise, or defense of legal claims.

8.5 Your Right to Restriction of Processing
You may request the restriction of the processing of your personal data in accordance with applicable laws and regulations.

8.6 Your Right to Object to Processing (Unsubscribe)
You have the right to object to the processing of your personal data where the processing is based on the legitimate interest of the data controller. In cases of direct communication, this right can be exercised by any means, including by clicking on the unsubscribe links at the bottom of the communications sent.

8.7 Your Right to Data Portability
You have the right to data portability. The data subject to this right are:

• Only your personal data, excluding anonymized data or data that does not concern you;

• Declarative personal data as well as operational personal data; and

• Personal data that does not infringe the rights and freedoms of others, such as those protected by trade secrets.

This right is limited to processing based on consent or contract and to personal data that you have personally generated. This right does not include derived or inferred data, which are personal data created by the data controller.

8.8 Your Right to Withdraw Consent
When the processing of your data is based on consent, you may withdraw it at any time. We will then cease processing your personal data without affecting previous operations for which you had consented.

8.9 Your Right to Lodge a Complaint
You have the right to lodge a complaint with the competent supervisory authority without prejudice to any other administrative or judicial remedy.

8.10 Your Right to Define Post-Mortem Directives
You have the right to define directives regarding the retention, erasure, and communication of your personal data after your death with a trusted third party, certified and responsible for enforcing the deceased's wishes, in accordance with applicable legal requirements.

8.11 Your Right to Object to Telemarketing
You are informed that if you do not wish to be subject to telemarketing, you have the right to object to it by registering your landline and/or mobile phone numbers on the free opposition list available at www.bloctel.gouv.fr. You are informed that your request will be effectively processed within 30 days from the confirmation of your registration, which is valid for a period of 3 years.

9. Data Security
We place great importance on the protection, integrity, and confidentiality of your data. Therefore, we have implemented technical and organizational measures to ensure a level of security appropriate to the risk, thereby protecting your data against any loss, alteration, access, or disclosure to unauthorized third parties.
However, despite our efforts, no security measure can completely prevent the risks of diversion or hacking, for which the data controller cannot be held liable.
In the event of a personal data breach and in compliance with applicable data protection regulations, we will notify the CNIL (French data protection authority). If a breach presents a high risk to your rights and freedoms, we will notify you as soon as possible, always in accordance with applicable data protection regulations.

For any questions regarding this privacy policy or to exercise your rights, please contact us at: contact@chateaudebarbe.fr.

Privacy policy