Privacy Policy — Le Clos des Vignes

Last updated: 28 July 2026.

Le Clos des Vignes attaches great importance to protecting your privacy. This policy explains what personal data we collect, why we collect it, with whom it is shared, how long it is retained and how you can exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

Le Clos des Vignes — THE WASHWOMEN
11/13 Rue des Vignes, 60119 Neuville-Bosc, France
Telephone: 03 44 22 36 90 · Email: [email protected]

If you have any questions regarding your personal data, please write to us at [email protected].

2. Data we collect

We only collect the data necessary for the purposes described below. Mandatory fields are marked on our forms.

Customer account : title, first name, surname, email address, telephone number, postal address, date of birth (optional), password stored in encrypted form, or Google login credentials if you choose this login method, holiday preferences.
Accommodation bookings : dates of stay, chosen accommodation, number of adults and children, total amount, special requests, additional services.
Restaurant and spa : date and time of booking, number of guests, treatments booked, and any allergies or dietary requirements that you choose to provide.
Gift vouchers and orders : the identity and contact details of the purchaser and the payee, a personal message, the delivery address (if applicable), the amount, the payment reference, the timestamp and the IP address at the time the terms and conditions of sale were accepted.
Payments : Credit card details are entered and processed directly by our payment service provider. We never store your card number: we are only provided with the transaction reference and the payment status.
Loyalty scheme : points earned, history of stays and orders.
Newsletters and communications : email address, date and source of consent, subscription status.
Contact forms and requests for quotes : your contact details and the content of your message.
Reviews and testimonials : content that you publish or authorise us to publish, together with the associated first name and initial.
Browsing data : IP address, browser and device type, pages viewed, date and time of connection, technical security logs.

Certain data may be considered sensitive (allergies, medical contraindications relating to treatment). This information is only collected if you provide it to us, for the sole purpose of ensuring your safety and comfort, and is accessible only to the relevant teams.

3. Purposes and legal bases

Management of bookings, stays and orders (accommodation, restaurant, spa, gift vouchers) — performance of the contract or pre-contractual measures.
Managing your customer account and the loyalty scheme — performance of the contract.
Payment processing and fraud prevention — performance of the contract and legitimate interest to secure transactions.
Responding to your enquiries and customer relations — legitimate interest to respond to enquiries.
Sending the newsletter and promotional offers — consent, or legitimate interest for similar offers sent to our customers, with the option to unsubscribe at any time.
Publication and moderation of reviews — consent.
Audience measurement and website improvement — consent collected via the cookie banner.
Accounting, tax and legal obligations (invoicing, tourist tax, registers) — legal obligation.
Site and systems security — legitimate interest.

4. Recipients and data processors

Your data is accessible to authorised staff at Le Clos des Vignes (reception, bookings, restaurant, spa, management, accounts), within the scope of their duties. We never sell or rent out your data.

We use the following service providers, acting as subcontractors or joint controllers:

Stripe — processing online credit card payments.
SiteMinder — distribution and management of accommodation bookings.
Planity — booking appointments and managing spa bookings.
Cloudflare, Inc. — website hosting, databases, file storage and protection against attacks.
Amazon Web Services (Amazon SES) — delivery of transactional emails and newsletters.
Google — linking to a Google account (if you use one), audience measurement and Google reviews, subject to your consent where required.

Your data may also be disclosed to administrative or judicial authorities where required by law.

5. Transfers outside the European Union

Certain service providers (including Stripe, Cloudflare, Amazon Web Services and Google) may process data outside the European Union. These transfers are governed by the safeguards provided for under the GDPR: the European Commission’s standard contractual clauses and, where applicable, an adequacy decision or additional technical measures.

6. Retention periods

Customer accounts and prospecting data : 3 years from your last interaction with us (stay, order, login, click).
Bookings and stays : duration of the contractual relationship, followed by archiving.
Accounting documents and invoices : 10 years, in accordance with the Commercial Code.
Gift vouchers : until they are used or expire, after which they are archived in accordance with accounting requirements.
Newsletter : until you withdraw your consent or after 3 years of inactivity.
Contact forms : 3 years from the date of the last exchange.
Published reviews : until you request a withdrawal.
Cookies and trackers : up to 13 months; associated audience data, up to 25 months.
Technical connection logs : 12 months.

7. Cookies and trackers

On your first visit, a banner will appear allowing you to accept, refuse or customise the use of cookies. No non-essential cookies will be set without your consent.

Strictly necessary cookies : security, account authentication, your shopping basket and the storage of your consent preferences. These do not require consent.
Audience measurement : visitor statistics to help improve the website. These will only be submitted with your consent.
Booking : cookies relating to the booking modules integrated into the website. These are only set once you have given your consent.

You can change your preferences at any time by clearing the website data stored by your browser — the banner will then reappear — or by adjusting your browser settings directly. You can also write to us at [email protected]. Rejecting non-essential cookies does not prevent you from browsing the website or making a booking.

8. Safety

We implement appropriate technical and organisational measures: encryption of data transfers (HTTPS), storage of passwords in hashed form, staff access controls, logging of administrative actions, and hosting with recognised service providers. In the event of a data breach likely to result in a high risk to your rights, you will be notified in accordance with Article 34 of the GDPR.

9. Minors

This website is not intended for children under the age of 15. To create an account or make a booking, you must be of legal age or be acting under the supervision of a legal guardian.

10. Your rights

Subject to the conditions set out in the regulations, you have the following rights:

the right to access your data and to obtain a copy of it;
the right to have inaccurate or incomplete data rectified;
the right to erasure (‘right to be forgotten’);
the right to restriction of processing;
the right to object, in particular to direct marketing;
the right to data portability in respect of the data you have provided to us;
the right to withdraw your consent at any time, without this affecting the lawfulness of any processing carried out previously;
the right to set out instructions regarding what should happen to your data after your death.

How can you exercise your rights? Please send your enquiry to [email protected] or by post to Clos des Vignes, 11/13 Rue des Vignes, 60119 Neuville-Bosc. Proof of identity may be requested if there is reasonable doubt as to your identity. We will respond within one month, which may be extended by two months in the case of a complex request.

You can also manage your details and preferences from your customer area, and unsubscribe from our communications via the link at the bottom of each email.

11. Complaint to the CNIL

If, after contacting us, you feel that your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL):
CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr

12. Changes to this policy

This policy may be amended to reflect changes to our services or to the regulations. The applicable version is the one published on this page, with the update date shown at the top of the document.