Privacy policy

SARL IL CASTELLO (SIRET 433 876 026 00025), 128 rue La Boétie, 75008 Paris, which runs the Casa di Gio rentals. For any question about your data: casadigio20@gmail.com.

When you write to us or book: your name, email, phone, the rental and dates, the number of adults and children, your language and your messages.

For payment and the deposit: you enter your card with Stripe, which keeps it; we have no access to it. We keep the Stripe references of your payments, their amounts, refunds and any deposit charge.

For foreign guests, if it is filled in, the police form the law requires: surname and first names, date and place of birth, nationality, usual address, mobile phone and email, arrival and departure dates, and the children under 15 travelling with you.

When you visit the site: the pages viewed, clicks and a recording of the visit (PostHog), with form fields masked, and technical errors (Sentry).

Answering your messages, handling your booking, the payment, the deposit and the stay, and writing to you about them: performing the contract, or steps taken at your request before entering into it (article 6.1.b GDPR).

Keeping accounts, declaring the tourist tax and filling in the police form: our legal obligations (article 6.1.c).

Measuring the site's audience and fixing its errors: our legitimate interest in running and improving the site (article 6.1.f).

We do not sell your data or use it for advertising.

Bookings and payments: 10 years after the end of the financial year, like accounting records (article L123-22 of the French Commercial Code).

Messages without a booking: 3 years after our last exchange.

Police forms: 6 months, then destroyed, as French immigration law requires.

Visit recordings: 30 days. Technical errors: 90 days at most. Database backups: 30 days.

Your data is only read by the family who runs the rentals and, each for its own service, by our processors: Stripe (payments and deposit), Resend (sending emails), Supabase (database, in Frankfurt), Render (site hosting, in Frankfurt), GitHub (database backups), Sentry (error tracking, in the European Union) and PostHog (audience measurement, in the European Union). The site's maps are shown by Google Maps, which receives your IP address.

Several of these companies are based in the United States. When data leaves the European Union, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

The police form is handed to the police and gendarmerie on their request.

Traffic with the site is encrypted (HTTPS). The admin is only open to family members, with their Google account.

You can ask to access, correct, erase or port your data, restrict its use, object to a use based on our legitimate interest, and decide what happens to it after your death. Email us at casadigio20@gmail.com: we answer within one month.

Data the law requires us to keep (accounts, police form) cannot be erased before the end of its retention period.

If you believe your rights are not respected, you can complain to the CNIL, the French data protection authority (cnil.fr).