Data Protection
Our vision of personal data protection
Given the relationship of trust that exists between La Grandterre sarl, its customers and partners, La Grandterre sarl wished to define a data protection policy in accordance with the requirements of the European regulation on the protection of personal data (GDPR).
La Grandterre sarl undertakes to protect, in particular, the privacy of its customers and partners (the data subjects), by ensuring the protection, confidentiality and security of the personal data collected.
La Grandterre SARL therefore wishes to concentrate in a single document clear, simple and precise information about the data processing that they are required to carry out so that each data subject can understand what information, personal data (hereinafter referred to as “personal data”) are collected, how they are used and what their rights are.
La Grandterre SARL has also appointed an internal representative and an external data protection officer (DPO). They may be contacted by any interested party at the following postal address: “Service DPO, La sarl La Grandterre, 15 rue du Caroux, 38114 Vaujany) or at the following email address: reservation@vdevaujany.fr .
1. Definitions
– “collect” means collecting personal data. This collection may be carried out during the booking, holiday(s) or contractual relationship between La Grandterre SARL and the persons concerned;
– “consent” means any freely given, specific, informed and unequivocal expression of intent by which the person concerned accepts, by a statement or by a clear positive act, that personal data concerning him or her is processed;
– “partners” means, in the broad sense, in particular service providers, subcontractors, intermediaries and service providers, working in relation with La Grandterre SARL;
– “products or services” means all products and services, including technological (sites, applications and associated services) offered or that will be offered by La Grandterre SARL;
– “prospect” means any person who has entered into a relationship with La Grandterre SARL to obtain information on a product or service offered by La Grandterre SARL;
– “data controller” means the person or organisation that, alone or jointly, determines the objectives and procedures for processing your personal data;
– “online services” means digital services offered by La Grandterre SARL such as websites, applications or associated services;
– “processing of personal data” means any operation or group of operations applied to the data, regardless of the process used.
2. The context of collection of personal data
Personal data may be collected primarily in connection with:
‐ the establishment of a relationship with La Grandterre SARL;
‐ the reservation of products and services offered by La Grandterre SARL;
‐ the use by the data subject of products and services at La Grandterre, including technological services (website, application, and associated services);
‐ the provision of products or services to meet specific customer requests;
‐ the relationship between La Grandterre sarl, its prospects, its customers and its partners;
‐ the performance of contracts;
‐ the performance of legal obligations or those covered by regulations specific to La Grandterre’s activities and having an impact on the protection of personal data (policy sheets for foreign customers, tourist taxes, tax, audit, anti-fraud, anti-money laundering and terrorist financing obligations, judicial requisition, etc.) ;
‐ as well as those relating to the management of the business relationship, in particular during complaints, or satisfaction surveys; …
3. The categories of data processed by La sarl La Grandterre
Personal data refers to any information relating to a natural person who can be identified directly or indirectly.
Personal data may thus be: the surname and first name, telephone number, photograph, video recording, postal address, email address, position, hobbies, location data, IP address of an individual’s computer.
Among the data collected by La Grandterre sarl, the following main categories exist:
3.1 Declarative personal data
Personal declarative data are those provided by the data subjects and collected by La Grandterre SARL in the context of commercial or contractual relations.
The data come mainly from data subjects, people authorised by data subjects to transmit them to La Grandterre.
For example, the data subject may be required to provide personal data relating to their preferences (e.g. food or press), their family, economic, wealth and financial situation, or that may make it possible to potentially deduce information relating to health, religious affiliation (food allergy, accessories for the practice of worship).
Personal data may also be collected in the context of the provision of accommodation.
3.2 Personal data on the operation of La Grandterre products and services
Personal data may come from the use by the data subjects of La Grandterre products and services or may relate to operations carried out via the products and services offered by La Grandterre sarl as part of its relationship with the data subject.
For example, information relating to the services provided during the stay of the data subject is collected in order to improve customer knowledge, comfort of the stay or the organisation of future stays.
3.3 Personal data from third parties
The personal data processed may also come from:
– booking intermediaries;
– loyalty programmes to which the customer has subscribed;
– subcontractors, partners of La Grandterre or third parties to La Grandterre if their personal data protection policies allow it;
– third parties (hotels, associations, police services, etc.) in the fight against fraud, non-payment and bad behaviour;
– other products or services provided by third parties to which the persons concerned have subscribed and/or for which they have authorised sharing with La sarl La Grandterre.
3.4 Public personal data
La Grandterre Sarl may collect public personal data concerning the data subjects, and use public personal information or data when authorised by legislative or regulatory texts and in compliance with the specific rules of communication and reuse specified by said texts.
3.5 Personal data calculated or inferred by La Grandterre Sarl
La Grandterre Sarl using declarative personal data or operating data may generate or calculate new personal data, with a view to adapting its products and services and personalising the offers that may be made to its customers.
3.6 Exclusion of special categories of data
In principle, special personal data are not collected. This personal data is data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic personal data, biometric personal data for the purpose of uniquely identifying a natural person, personal data concerning health or personal data concerning a natural person’s sex life or sexual orientation.
These categories of special personal data, which must be subject to special attention, may however be processed by La sarl La Grandterre, under the conditions laid down by the regulations relating to the protection of personal data.
For example, certain requests for products or services may make it possible to potentially deduce information relating to health and religious affiliation (food allergy, accessories for worship).
4. Personal data processed by La Grandterre sarl
For customers and their companions, the following main personal data are processed by La Grandterre sarl:
– Title
– Surname / first name;
– Gender;
– Date of birth / age;
– Languages;
– Nationality/place of origin;
– Contact details (postal address, email address and telephone number);
– Employer in the event of booking for professional purposes;
– Profession (business cards);
– Duration and date of booking, and stays;
– Preferences or specific requests expressed during the booking and/or stay;
– Special points for attention necessary for the smooth running of the stay (such as the risks of allergies or medical information relating to contraindications in the context of the spa).
For prospects:
– Surname / first name;
– Gender;
– Date of birth / age;
– Languages;
– Contact details (postal address, email address and telephone number);
– Bank details;
– Connection data (IP, logs, trackers);
– Logs.
For partners:
– Title;
– Identity;
– Gender;
– Private address;
– Business address;
– Name of legal representative;
– Name of employer;
– Telephone (Landline, Mobile, Business;)
– Business email address;
– Internal identification code;
– Accountant;
– Contract;
– Professional bank details;
– VAT no.;
– Date of entry;
– Date of update.
5. Recipients of the data collected by La Grandterre sarl
The personal data collected, as well as those that will be collected later, are intended for La Grandterre in its capacity as data controller.
La Grandterre sarl ensures that only authorised persons can access the personal data of the persons concerned and when necessary for the performance of their missions.
Certain personal data may be sent to third parties to meet legal, regulatory or contractual obligations or to legally authorised authorities (police prefecture, Vaujany town hall, obligations in respect of the fight against money laundering and terrorist financing, Tracfin declaration, etc.).
At the request of their customers, La Grandterre sarl may send personal data to third parties in order to subscribe to products and services from these third parties (restaurant bookings, private cars, trips or shows). The customer is informed that La Grandterre sarl are only responsible for their own processing and that consequently customers are invited to contact the third party recipients to be informed of the terms and conditions of any processing carried out.
6. Storage of personal data
Personal data is stored in the information systems at La Grandterre or in those of its subcontractors or service providers.
As a matter of principle, La Grandterre SARL undertakes to choose subcontractors and service providers that meet the best quality and safety criteria and provide sufficient guarantees, in terms of reliability, security and resources, for the implementation of technical and organisational measures.
7. Principles applicable to personal data
The regulations relating to the protection of personal data set out several main principles that La Grandterre SARL undertakes to strictly comply with.
7.1 Lawfulness of processing
La Grandterre SARL and each of its employees undertake not to process data collected in an unlawful manner.
Processing is lawful insofar as at least one of the following conditions is met:
– the data subject has consented to the processing of his/her personal data for one or more specific purposes (this consent may be given by means of a written declaration, including by electronic means, or an oral declaration);
– the processing is necessary for the performance of a contract to which the data subject is a party or the performance of pre-contractual measures taken at the request of the latter;
– the processing is necessary for compliance with a legal obligation to which La sarl La Grandterre is subject;
– the processing is necessary to safeguard the vital interests of the data subject or another natural person;
– the processing is necessary for the performance of a mission in the public interest or in the exercise of public authority entrusted to La Grandterre sarl;
– the processing is necessary for the purposes of the legitimate interests pursued by La Grandterre sarl or by a third party.
The processing carried out by La Grandterre sarl is only implemented if at least one of the previous conditions is met.
7.2 Legitimate purpose
Personal data is collected and processed at all times by La Grandterre SARL for specified, explicit and legitimate purposes.
La Grandterre SARL uses personal data in accordance with the terms of this data protection policy and the general terms and conditions of the products and services subscribed to by the customer, with a constant concern for the privacy and security of its customers’ personal data.
La Grandterre SARL uses all or part of the personal data for the following main purposes:
– the performance of pre-contractual measures taken at the request of the data subjects;
– the performance and performance of the services;
– the management of its customers’ bookings and stays
– the management of relations with its partners;
– the management of contracts concluded with the persons concerned;
– management of its activities;
– management of its websites;
– measurement of the quality and satisfaction of its customers;
– customer satisfaction;
– continuous improvement in the quality of its products and services;
– improvement of knowledge of its customers;
– establishment of statistics.
7.3 Loyalty and transparency
La Grandterre Sarl is committed to providing fair, clear and transparent information.
La Grandterre Sarl has the means to provide any necessary details regarding its data protection policy at the request of the data subject.
7.4 Personal rights
Persons whose data is processed benefit from the following rights, unless otherwise required by law by La Grandterre:
– the right to information;
– the right of access;
– the right to rectification;
– the right to erasure or the right to be forgotten;
– the right to portability;
– the right to object;
– the right to restrict processing;
– the right to question.
7.4.1 Procedures for exercising these rights
In the event of a question or request relating to the processing of personal data by La Grandterre sarl, the persons concerned are invited to contact the internal contact at “reservation@vdevaujany.fr”.
7.4.2 Right to information
By this data protection policy, the persons concerned acknowledge that they are informed of the purposes, the legal framework, the legitimate interests pursued by La Grandterre sarl, the recipients or categories of recipients with whom their personal data are shared, and the possibility of transferring the data to a third country or an international organisation.
However, with regard to the right to information, La Grandterre SARL may not be obliged to follow up if the data subjects have this information, if the registration or communication of their personal data is expressly provided for by law, or if the communication of information proves impossible or would require disproportionate efforts.
7.4.3 Right of access and rectification
The data subjects have a right of access and rectification with La Grandterre.
In this respect, the data subjects may have confirmation that personal data concerning them are or are not processed and, when they are, access to said personal data.
Data subjects may ask La Grandterre to correct and complete their personal data if they are inaccurate, incomplete, ambiguous or out of date.
Any request for the right of access and rectification must be made by hand-written letter with a copy of an identity document.
7.4.4 Right to erasure or right to be forgotten
Data subjects may ask La Grandterre to erase their personal data when one of the following reasons applies:
– personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
– if the person withdraws their consent;
– if they object to the processing of their personal data when there is no legal reason for such processing;
– if the processing of personal data does not comply with the provisions of the applicable legislation and regulations.
Nevertheless, the data subjects are informed that the exercise of this right to erasure will not be possible when the retention of their personal data is necessary under the legislation or regulations and, in particular for example, the exercise of the right to freedom of expression and information, or the establishment, exercise or defence of legal rights.
7.4.5 Right to portability
Given the nature of the offer of products and services offered by La Grandterre SARL, the exercise of this right is not applicable and insofar as the personal data collected by La Grandterre SARL are not concerned by the right to portability.
7.4.6 Right to object
The data subject has the right to object, for reasons relating to his or her particular situation, to the processing of personal data at any time.
In the event of the exercise of such a right of objection, La Grandterre sarl shall cease the processing except where there are legitimate and compelling reasons for the processing that prevail over the interests and rights and freedoms of the data subject or for the establishment, exercise or defence of a right in court.
7.4.7 Right to restriction of processing
Data subjects may request restriction of processing in the cases provided for by the regulations concerning the protection of personal data.
7.4.8 Right of appeal
Data subjects have the right to lodge a complaint under the conditions set out in the “Right of access and rectification” paragraph above, without prejudice to any other administrative or judicial appeal.
7.5 Proportionality
For each processing operation, La Grandterre SARL undertakes to ensure that the processing is adequate and to collect and process only data strictly necessary for the purpose pursued.
7.6 Automated decision-making
There is no automated decision in the context of the processing carried out by La Grandterre sarl.
7.7 Retention period and limitation
La Grandterre sarl undertakes not to retain personal data for longer than is necessary for the purposes for which it is retained or for longer than the period provided for by the regulations relating to the protection of personal data.
7.8 Data accuracy
La Grandterre Sarl undertakes to ensure that it collects complete data as current as circumstances allow.
7.9 Framework for transfers outside the European Union
Personal data that persons located on EU territory have transferred to La Grandterre, in accordance with the agreed purposes, may be transferred to a country of the European Union or outside the European Union.
As part of a transfer to a country outside the European Union, rules ensuring the protection and security of this information are put in place.
In all cases, La Grandterre SARL shall take all necessary and appropriate measures to ensure the security of personal data and only for the processing for which it is responsible or co-responsible.
This personal data may be communicated, at the request of the persons concerned, to official bodies and authorised administrative or judicial authorities, or to third parties. In this case, the persons concerned are invited to contact the third parties concerned to ensure the conditions under which their data will be processed.
7.10 Security and confidentiality undertaking
La Grandterre Sarl undertakes to implement security measures appropriate to the degree of sensitivity of the personal data to protect them against malicious intrusion, loss, alteration or disclosure to unauthorised third parties.
Since all personal data is confidential, their access is limited only to duly authorised persons who need it in the context of the performance of their mission, thanks to technical devices implemented in the electronic system. All persons with access to the data are bound by a duty of confidentiality and are exposed to disciplinary measures and/or other sanctions if they do not comply with these obligations.
Nevertheless, the security and confidentiality of personal data are based on the best practices of each person and the persons concerned are invited to be vigilant.
8. Professional secrecy
Pursuant to the regulations in force, persons who process the data of the persons concerned managed by La Grandterre sarl under an employment contract or a contract are required to keep secret from third parties everything they learn during their professional activity.
9. Special treatments
As part of the implementation of security measures, La Grandterre sarl uses video surveillance systems in some of its premises in accordance with applicable regulations.
The persons concerned are informed that these images are recorded and stored and that they may lead to the identification of persons filmed either by the systems implemented or by authorised persons with access to the images.
Signs in filmed locations indicate to the persons concerned the existence of this type of system, the person in charge and the procedures for exercising their right of access to the visual recordings concerning them.
10. Contact and details
For any question or in the event of difficulty in understanding or applying the rules defined in this policy, you can contact the internal relay at the external DPO: reservation@vdevaujany.fr
Consent to data collection
I give my consent for La Grandterre SARL and the companies in its group to use my surname, first name and email address to send me a newsletter about their activities.
This data is kept until I withdraw my consent and is intended for the services at La Grandterre in charge of managing the relationship with customers.
I have been informed that I have the to information, access, rectification, erasure, portability and restriction of processing.
I also have the right to object on legitimate grounds and to object to commercial prospecting.
These rights may be exercised through the unsubscribe link included in the information letters or with the data protection officer by email reservation@vdevaujany.fr or by post to the following address: La sarl La Grandterre, Relais interne du DPO, 15 rue du Caroux, 38114 Vaujany, accompanied by a copy of an identity document signed by you.
The terms and conditions of the La Grandterre data protection policy are available on the website: https://www.vdevaujany.fr
In the event of a dispute, you may refer the matter to the competent supervisory authority: the CNIL (www.cnil.fr)
Contact us
I give my consent to La Grandterre sarl and the group companies using my surname, first name and email address to respond to requests for information. This processing is necessary for the performance of the requested pre-contractual measures.
These data are kept until I have withdrawn my consent and at the latest for a period of three years are intended for the services of La Grandterre in charge of managing the relationship with customers.
I have been informed that I have the right to information, access, rectification, erasure, portability and restriction of processing.
I also have the right to object on legitimate grounds and to object to commercial prospecting.
These rights may be exercised through the unsubscribe link included in the information letters or with the data protection officer by email reservation@vdevaujany.fr or by post to the following address: La sarl La Grandterre SA, Relais interne du DPO, 15, rue du Caroux, 38114 Vaujany, accompanied by a copy of an identity document signed by you.
The conditions of the data protection policy at La Grandterre are accessible on the website: https://www.vdevaujany.fr
In the event of a dispute, you may refer the matter to the competent supervisory authority: the CNIL (www.cnil.fr)