Privacy Policy

Processing is governed by the French Data Protection Act (loi Informatique et Libertés) as it applies in French Polynesia, which refers to the protection rules set out in the GDPR, subject to the adaptations specific to this territory.

1. Data controller and contact

The data controller is:

Thierry Havelange, trading under the name Villa Paradise Tahiti.

Address: Lot 5, Mata Miti Temaruata, Punaauia, Tahiti, French Polynesia.

Email: villa.paradise.tahiti@gmail.com

This policy covers the processing whose purposes and means we determine. Booking platforms, payment providers and other third-party services may also process your data under their own responsibility, in accordance with their respective policies.

2. Data we may collect

We limit collection to the data needed to run our business and provide the services you request.

Depending on how you interact with us, this data may include:

• Identity and contact details: last name, first name, email address, phone number, postal address and country of residence.
• Booking and stay: dates, number of guests, services requested, booking amount and information needed to welcome you.
• Communications: requests, correspondence, complaints and documents needed to handle them.
• Transactions: payment status, amount, currency, transaction reference and information provided by the payment provider.
• Browsing: IP address, technical characteristics of your device and browser, pages viewed and events needed for operation, security or, where permitted, audience measurement.

We may receive some of this information through the platforms on which you book.

Mandatory data is flagged when it is collected. Without it, we may be unable to process a request, a payment or a booking. Other information is optional.

Data about other travelers

If you send us information about the people traveling with you, you must tell them about it and about this policy. Only share the information needed to organize the stay.

Sensitive information

Please avoid sending us medical records or sensitive information that is not needed.

When you choose to tell us about an allergy, an accessibility need or other information revealing your health, we limit its use to organizing the requested service. Where the law requires it, we obtain your explicit consent before processing or passing on this information.

Identity verification

We may ask you to show proof of identity where this is necessary and legally justified, in particular to verify the identity of the person booking, prevent fraud or meet an applicable obligation.

Showing a document does not mean it is systematically copied. Any copy that may be kept must meet a documented need and be subject to an appropriate retention period.

3. Purposes and legal bases of processing

We use your data to:

• Answer your requests and prepare a booking: pre-contractual steps taken at your request.
• Perform the booking and the agreed services: management of the contract, your welcome, payments and communications about the stay.
• Meet our obligations: legal, tax and accounting obligations, or lawful requests from the authorities.
• Ensure security and defend our rights: our legitimate interest in preventing fraud, protecting our systems, handling complaints and keeping the necessary evidence, subject to your rights and freedoms.
• Send marketing communications: prior consent, except where the law allows us to offer our own similar services to existing customers, with notice and a free opportunity to object at collection and in every message.
• Use optional trackers: prior consent where required.

We do not use your data to make decisions based solely on automated processing that produce legal effects concerning you or similarly significant effects.

4. Payments

Online payments are processed by the provider offered at the time of payment, in particular PayPal when this option is available.

Never send your full card number or its security code by email, messaging or contact form.

Data entered in the provider's interface is processed under its own terms and privacy policy. We use the transaction information shared with us to manage payments, refunds, accounting reconciliation and any disputes.

5. Recipients of data

Access to data is limited to the people and organizations who need it for the purposes described in this policy.

Depending on the services actually used, recipients may include:

• the people authorized to manage bookings and guest reception;
• technical providers for hosting, storage, email and security;
• payment providers and booking platforms;
• providers of the activities or services you request;
• our professional advisers;
• the competent authorities, where disclosure is required or permitted by law.

For an outside activity or service, we only pass on the information needed to organize it. Sensitive information receives particular care and, where required, your explicit consent.

6. Cookies and audience measurement

Trackers that are strictly necessary for the site to work, or to provide a service you have expressly requested, may be used without consent where the law allows.

Optional trackers for analytics, session recording or advertising that require your consent are only activated once you agree.

You can accept, refuse or customize optional trackers with the same ease, and change your choice at any time. Continuing to browse or remaining silent does not amount to consent.

Refusing optional trackers does not prevent you from requesting or making a booking.

Information available from the cookie management tool details the tools used, their purposes, their providers and their durations.

7. Marketing communications

When we send you marketing communications, you can unsubscribe using the link in the message or by writing to us.

Unsubscribing does not stop the communications needed for a booking, a payment or the handling of a complaint.

We may keep the minimum information needed to respect your objection to marketing on a lasting basis.

8. External links and affiliation

The site may offer links to booking platforms, activity providers or flight search services.

When you use these services, their own policies apply to the processing they carry out. Clicking a link does not, by itself, amount to general consent to all of their processing.

When a link is an affiliate link that may earn us a commission, its commercial nature is indicated next to the link.

9. International transfers

Our business is located in French Polynesia. Some providers may process or host data in other countries, in particular the United States or the European Economic Area.

Where the applicable rules require specific safeguards, transfers must rely on an appropriate legal mechanism, such as an applicable adequacy decision or standard contractual clauses supplemented, where necessary, by additional measures.

You can contact us for information about the safeguards that apply to your data.

Visiting the site or booking a stay does not amount to general consent to an international transfer lacking the required safeguards.

10. Retention

We keep data for a period proportionate to its purpose.

• Requests without a booking, and marketing: up to three years after collection or your last active contact, unless deleted earlier. A message we send that receives no response from you does not restart this period.
• Booking management: during the preparation and performance of the stay; afterwards, only the necessary data is moved to restricted-access archives to meet legal obligations and defend our rights for the applicable periods. The internal schedule distinguishes debt collection, possible claims by guests and accounting obligations.
• Accounting and tax records: for the period required by the applicable texts. This does not justify keeping the entire guest file for the same period.
• Sensitive information useful for the stay: deleted as soon as it is no longer needed, unless a legal obligation or a justified need related to a dispute applies.
• Proof of identity: no systematic retention; any retention meets a documented need and period.
• Trackers and audience data: for the durations stated in the cookie information.
• Complaints, fraud and disputes: for as long as needed to handle them and defend our rights.

Backups are deleted or renewed according to their technical cycle and remain protected throughout that period.

10a. Security camera footage

There is a camera in the garage. How the system actually works is described in a notice provided before booking and displayed at the entrance to the monitored area. This notice states the field of view, the periods of operation, the legal basis for processing, whether footage is recorded, how long it is kept and who receives it, any providers involved, and how to exercise your rights. Simply accepting the terms of the stay is not general consent to surveillance.

When an incident justifies extracting footage, only the relevant sequences are kept separately, with restricted access, for as long as needed to handle it or for proceedings. The system must not intrude disproportionately on privacy or monitor private spaces.

11. Security

We implement technical and organizational measures appropriate to the risks to protect data against unauthorized access, loss, alteration or disclosure.

No computer system or internet transmission can, however, guarantee absolute security. This limitation does not reduce our legal data protection obligations.

In the event of a data breach, we make the required notifications to the authorities and to the people concerned.

12. Your rights

Under the applicable rules and the conditions they set, you may request:

• access to your data and its correction;
• its erasure or the restriction of its processing;
• its portability;
• to object to processing based on our legitimate interest;
• an end to marketing communications;
• to withdraw your consent, without affecting the lawfulness of earlier processing.

Some rights may be limited where retention or processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Send your request to villa.paradise.tahiti@gmail.com.

If we have reasonable doubts about your identity, we may ask for the information strictly necessary to verify it, without systematically requiring a full copy of your identity document.

We respond within one month of receiving the request. Where the applicable rules allow a two-month extension because of the complexity or number of requests, we will inform you of the extension and the reasons for it within the first month. Exercising your rights is in principle free of charge, subject to the legal exceptions for manifestly unfounded or excessive requests.

You may also lodge a complaint with the CNIL (the French data protection authority) at www.cnil.fr, or with another competent authority depending on your situation.

13. Guests residing in the United States

Residing in the United States does not deprive you of the rights granted by the rules that apply to our processing.

Where the conditions for applying a US data protection law are met, we handle the corresponding requests in accordance with that law, including requests submitted by a duly authorized agent.

The rights provided by the California CCPA/CPRA or by the laws of other states apply to the extent that our business and the processing concerned fall within their scope.

Nothing in this policy constitutes a waiver of any mandatory right you enjoy.

14. Minors

The site and its booking process are intended for adults. Minors may stay at the villa under the responsibility of the adults accompanying them.

We limit the information about them to what is needed for the booking, their welcome and our legal obligations.

If you believe a minor has sent us data directly and inappropriately, please contact us so that we can review the situation and take the necessary steps.

15. Changes

This policy may be updated to reflect changes in our services, our practices or the law.

The date at the top of the document identifies the version in force. Changes that require specific notice or new consent are handled accordingly.

A change does not allow your data to be used retroactively for a new, incompatible purpose without the required legal basis.