Privacy policy

The data controller is the chalet's owner, who runs this site and handles bookings directly. No intermediary platform is involved.

Only what you give us, plus what the server records technically. Nothing is inferred, bought or cross-referenced with other sources.

• Your identity and contact details: first name, surname, email address, telephone, country of residence.
• Stay details: arrival and departure dates, number of adults and children, pets, chosen options, any promotional code.
• The free-text message you write, and how you heard about us, if you tell us.
• Billing details passed on by Stripe after a payment: name, billing address, transaction reference, last four digits and card type.
• The server's technical log: IP address, timestamp and requested page, for security and troubleshooting.

Each processing operation serves a defined purpose and rests on a GDPR legal basis. We use your data for nothing else.

Answering your enquiry

Pre-contractual measures

Performing the letting and welcoming you

Performance of the contract

Taking payment and placing the deposit hold

Performance of the contract

Keeping accounting records

Legal obligation

Securing the site and preventing fraud

Legitimate interest

The circle is deliberately narrow. Each recipient is involved for one specific reason, and that reason alone.

• The owner, and the person appointed to handle arrivals, departures and rental management.
• Stripe Payments Europe, Ltd. (Dublin, Ireland), for payment, the deposit hold and fraud prevention.
• Our host, which stores the site and the booking files.
• The Oasis Village reception, for your registration on the estate and the Fun Pass — strictly the information that formality requires.
• The tax authorities or a judicial authority, where the law requires it.

Beyond these periods, data is deleted or anonymised. The ten-year accounting period is imposed by commercial law; we cannot shorten it.

Enquiries without a booking

3 years from the last contact

Bookings and accounting records

10 years, accounting obligation

Server technical log

12 months

Your booking data stays hosted in the European Union. Stripe, our payment provider, is established in Ireland, but its group may carry out some processing in the United States; those transfers are framed by the European Commission's standard contractual clauses and by the group's certification under the EU–US Data Privacy Framework.

Write to the contact address at the foot of this page. We reply within one month. To stop anyone exercising your rights in your place, we may ask you to prove your identity.

• Access the data we hold about you, and obtain a copy.
• Have anything inaccurate or incomplete corrected.
• Request erasure, within the limits of our accounting obligations.
• Request restriction of a processing operation, or object to it.
• Receive your data in a machine-readable format, to take it elsewhere.
• Set directions on what becomes of your data after your death.

This site sets no analytics cookies and shows no advertising. That is why you see no consent banner here: there is nothing to consent to.

Two exceptions, both technical. At payment time, Stripe sets the cookies needed for the transaction to complete and for fraud detection; they are exempt from consent because you asked for them by clicking “pay”. And the map of the surroundings loads its tiles from OpenStreetMap: your IP address is then passed to the OpenStreetMap Foundation, as with any image served by a third party.

The site is served exclusively over HTTPS. Configuration files and booking data are stored beyond the reach of the web by the server configuration. Payment is entirely delegated to Stripe, certified PCI-DSS Level 1, and administration access is password-protected.