Privacy policy.

1. Data controller

Identity

GTA GO TO AGENCY

Registered office

9 rue Jean-Jacques Rousseau, 21000 Dijon

SIREN

944 980 762

GDPR contact

contact@beaune-conciergerie.com

2. Purposes, legal bases, retention periods

We process your personal data only for the purposes described below, each based on an identified legal ground under article 6 of the GDPR. No further processing is carried out for a subsequent purpose incompatible with those declared below.

3. Sub-processors and technical partners

Under article 28 of the GDPR, we use sub-processors offering sufficient guarantees on data protection. Each sub-processor is bound by a Data Processing Agreement imposing compliance with the GDPR.

4. Data transfers outside the European Union

Some technical operations may involve a transfer of data to the United States (Vercel hosting, transactional e-mail). These transfers are governed by the Standard Contractual Clauses approved by the European Commission (Decision 2021/914 of 4 June 2021), under article 46 of the GDPR.

Vercel Inc. is also certified under the EU-U.S. Data Privacy Framework (DPF) in force since 10 July 2023, which is a complementary guarantee of adequate protection recognised by the European Commission.

5. Data security

Under article 32 of the GDPR, we put in place appropriate technical and organisational measures to ensure a level of security suited to the risk:

• Systematic TLS 1.3 encryption of communications (HTTPS)
• AES-256 encryption at rest for sensitive data (bank details, supporting documents)
• bcrypt hashing of user passwords
• Access limited to strictly authorised staff (least-privilege principle)
• Two-factor authentication on every administrator account
• Daily encrypted backups with 30-day rotation
• Annual penetration tests by an independent provider
• Documented breach notification procedure within 72 hours (GDPR art. 33)

6. Your data rights

Under articles 15 to 22 of the GDPR, you have the following rights at all times:

• Right of access: confirmation whether your data is processed and a copy thereof (art. 15)
• Right of rectification: have inaccurate or incomplete data corrected (art. 16)
• Right of erasure (right to be forgotten): have your data deleted under the conditions set out in (art. 17)
• Right to restriction: temporarily suspend a processing operation (art. 18)
• Right to portability: receive your data in a structured, machine-readable format (art. 20)
• Right to object: object to processing based on legitimate interest or to direct marketing (art. 21)
• Right to withdraw consent: withdraw at any time your consent where processing relies on it (art. 7.3)
• Right to set post-mortem directives on the fate of your data (article 85 of the French Data Protection Act)

To exercise your rights, write to contact@beaune-conciergerie.com attaching a copy of an ID document. Reply within 1 month maximum (extendable by 2 months for a complex request, you will be informed).

7. Complaint to the CNIL

If, after contacting us, you consider that your rights have not been respected, you may file a complaint with the French data protection authority (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, by telephone on +33 (0)1 53 73 22 22, or online at cnil.fr/fr/plaintes.

8. Cookies and trackers

The site beaune-conciergerie.com uses no advertising cookies and no third-party trackers requiring prior consent. Audience measurement is provided by Datalenk: the site loads its script (in.datalenk.com/dl.js) in its default, cookieless mode. In that mode the script writes nothing to your device, neither cookies nor local storage, and uses a short-lived identifier for each page view. It measures nothing when your browser sends the Do Not Track signal.

The script sends the page address, the referring page, campaign parameters (utm, gclid, fbclid), browser language, window size, time spent and reading depth, aggregated click positions and performance measurements; on a share of page loads it also sends the names of third-party domains loaded by the page and JavaScript error messages. Its code states that page views from the same visit are grouped on the server using the IP address and the browser.

Datalenk is operated by GTA Go To Agency SAS, a French company. This data is hosted in Germany, on Hetzner servers, and never leaves the European Union. The detail of visits is kept for 25 months, then permanently deleted.

Your click on "J'ai compris" in the information banner is remembered in your browser's local storage, so that the banner is not shown again. It is not sent to anyone, and you can clear it at any time from your browser settings.

9. No automated decision-making

GTA GO TO AGENCY carries out no fully automated decision-making (within the meaning of GDPR article 22) producing legal effects or significantly affecting data subjects. Our pricing estimates are systematically reviewed and validated by a human before being sent.

10. Protection of minors

The site and services of GTA GO TO AGENCY are not addressed to minors under 15 (the digital consent age in France under the law of 7 July 2020). We knowingly collect no data concerning minors. If you find out that your child has sent us personal data without parental authorisation, please contact us for immediate deletion.

11. Changes to this policy

This policy may be amended, in particular to reflect changes in regulation, our services or our sub-processors. Any substantial change will be notified by e-mail (if you are a client) and flagged on the site. The last update date is shown at the top of this page.