Privacy policy

The data controller is STAYFLEX IMMO, société par actions simplifiée with capital of 1 000 €, registered office at 32 allée de la Robertsau, CS 40034, 67000 Strasbourg, entered in the Registre du Commerce et des Sociétés de Strasbourg under number 930 893 698.

For any question about your personal data, write to gestion@stayflex-immo.com or to the registered office address.

We collect only the data needed for the booking and the stay.

When you book:

• first and last name of the main guest
• email address
• telephone number
• arrival and departure dates, number of guests and split between adults and minors
• any free-text message you send us
• any promotional code used

The split between adults and minors is requested because the tourist tax is calculated per liable person: under-18s are exempt.

When you pay: your card details are entered directly in the secure interface of our payment provider. They do not pass through our servers and we never have access to them. We keep only the status of the transaction and its identifier.

As you browse: your search criteria (dates and number of guests) are kept in your browser’s local storage so you do not have to enter them again from one page to the next. They are cleared when the tab is closed and are never sent to us.

Each processing operation rests on a specific legal basis.

• Managing your booking and your stay: creating the booking, sending the confirmation, providing access details, communicating during the stay. Legal basis: performance of the contract.
• Collection and invoicing: processing the payment, issuing the invoice, collecting and paying over the tourist tax. Legal basis: performance of the contract and legal obligation.
• Accounting and tax obligations: retention of supporting documents. Legal basis: legal obligation.
• Handling complaints and disputes: dealing with your requests and, where applicable, establishing or defending a right. Legal basis: legitimate interest.

We do not use your data for marketing purposes without your prior consent.

Your data is processed by authorised staff at STAYFLEX IMMO and by the following technical processors, acting on our instructions.

• <<https://stay-core.com/|STAYCore>>: property management software that hosts bookings, calendars and stay data.
• Stripe Payments Europe Limited: processing of card payments.
• Vercel Inc.: hosting of the site.

Certain data may be passed to the municipalities concerned as part of collecting the tourist tax, and to our advisers and the tax authorities where the law requires. Your data is never sold, rented or transferred to third parties for commercial purposes.

Some of our providers are established in the United States or may process data there. These transfers are covered by the safeguards set out in Chapter V of the General Data Protection Regulation, in particular the standard contractual clauses adopted by the European Commission and, where applicable, certification under the European Union to United States data protection framework.

• Booking data: kept for the duration of the contractual relationship, then archived for three years from the end of the stay, the limitation period applicable to claims between a trader and a consumer.
• Accounting records and invoices: ten years from the close of the financial year, in accordance with the French Commercial Code.
• Email exchanges with no follow-up: three years from the last contact.
• Payment data: kept by our provider according to its own periods, and thirteen months for transaction data in the event of a chargeback.

Exchanges with this site are encrypted using HTTPS. Access to booking data is restricted to authorised staff and protected by authentication. Payments are handled by a provider certified to the PCI DSS standard.

We use Google Analytics to measure how this site is used: number of visitors, pages viewed, where visits come from and the paths that lead to a booking. This measurement helps us improve the site and assess our advertising campaigns.

Nothing is stored without your consent. No measurement tracker is activated until you have accepted, and the Google script is not even downloaded. Declining is as simple as accepting, does not degrade your visit in any way, and your choice is kept on your device. You can change it at any time by clearing your browser’s site data for this domain, which brings the consent request back.

Measurement data is collected by Google Ireland Limited, acting as a processor, and may be transferred outside the European Union under the European Commission’s standard contractual clauses. Your IP address is truncated before any recording. Retention is limited to fourteen months. We have also signed the data processing amendment provided for by the GDPR.

Regardless of that choice, we use your browser’s local storage to keep your search criteria during your visit, along with the technical cookies set by our payment provider at the time of the transaction, which are essential to securing it and preventing fraud. Both uses are strictly necessary to the operation of the site and do not require your consent.

You have the following rights over the data concerning you: access, rectification, erasure, restriction of processing, portability and objection. You may also set directives on what happens to your data after your death.

To exercise these rights, write to gestion@stayflex-immo.com setting out your request. We may ask for proof of identity where there is reasonable doubt about the identity of the person making the request. We reply within one month, extendable by two months where the request is complex.

Some requests may be limited by our legal obligations: we cannot erase an invoice before the statutory retention period has expired.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority: Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

[to complete: contact details of the data protection officer, if the company has appointed one; that appointment is not mandatory here]

This policy may be updated to reflect legal or technical developments. The date of the last update appears at the top of the page. In the event of a substantial change, we inform the people concerned by any appropriate means.