Privacy policy

1. Data controller

The data controller is SCI IMMO TORDESILLAS, a French property-holding civil company registered under SIREN number 851 377 986 and SIRET number 851 377 986 00019, trading as Love Room Spa, 28 allée des Hortensias, 78710 Rosny-sur-Seine, France. William Xavier is operationally responsible for Love Room Spa and is the point of contact for data subjects.

For any question or request concerning personal data, use the contact form or call +33 (0)7 87 33 97 66.

2. Data processed

Depending on the services used, Love Room Spa processes identity and contact data, telephone numbers, booking and stay information, selected options, information required for gift cards, personal messages, customer-service correspondence, order data, payment references, IP addresses, security logs and browsing data.

Payment providers process the bank details required for the transaction. Love Room Spa does not receive the full bank-card number.

3. Purposes and legal bases

Data is used to answer enquiries, display availability, manage bookings, process payments, issue and check gift cards, prepare options, send confirmations, manage the security deposit, provide support for the stay, handle cancellations, prevent fraud, secure the website, comply with accounting and legal obligations, measure the audience where the legal framework allows it, and improve the user journey.

The legal bases are performance of the contract and pre-contractual measures, compliance with legal obligations, Love Room Spa’s legitimate interests in security, fraud prevention and service improvement, and consent where it is required for trackers or optional communications.

4. Mandatory information

Fields marked as mandatory are required to process the request or fulfil the booking. Without this information, Love Room Spa may be unable to respond, confirm the order or provide the service.

5. Recipients

Data is accessible to authorised Love Room Spa personnel and, within the limits of their respective tasks, to the providers of hosting, maintenance, booking, e-commerce, payment, email delivery, security and audience measurement services, as well as communication services chosen by the user.

These providers include PlanetHoster for hosting; WordPress, WooCommerce and MotoPress for the website and booking; the payment providers offered during checkout; Google when audience measurement is enabled; and WhatsApp when the user voluntarily chooses that channel.

Data is not sold.

6. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area. Where this occurs, Love Room Spa relies on a mechanism recognised by applicable law, including an adequacy decision or standard contractual clauses, and applies any necessary supplementary safeguards.

Detailed information about processing locations and safeguards can be requested through the contact form.

7. Retention periods

Contact enquiries that do not lead to a booking are kept for as long as required to deal with them and then for no more than 3 years from the last exchange where commercial retention is justified.

Data required to fulfil a booking is kept throughout the contractual relationship and then archived for the applicable limitation periods. Accounting records and invoices are kept for 10 years.

Gift-card data is kept for the card’s validity period and then for as long as required to manage complaints, fraud and accounting obligations.

Security logs and technical data are kept for a period proportionate to the security purpose. Retention periods for cookies and audience measurement are shown in the consent manager and do not exceed the duration configured for each service.

8. Cookies and audience measurement

Strictly necessary cookies enable the website, basket, booking, security and storage of consent choices to function.

9. Contact form and response statistics

The form may collect the topic, subtopic, source page, name, email address, telephone number and message. A booking reference and stay date may be requested where useful.

Answers indicating whether an FAQ resolved the question may be counted in aggregate. They must not contain the message text or the visitor’s contact details.

10. Security

Love Room Spa implements technical and organisational measures appropriate to the risk, including encryption of communications, access control, updates, backups, security logging and limits on accessible data.

No internet transmission can be guaranteed to be entirely risk-free. If an incident poses a risk to individuals, the notifications required by law are made.

11. Your rights

Depending on the processing concerned, you have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

You can exercise your rights through the contact form. Proof of identity may be requested only where necessary to prevent disclosure to a third party.

You may also lodge a complaint with the CNIL, the French data-protection authority.

12. Automated decisions and minors

Love Room Spa does not make decisions that produce legal effects solely on the basis of automated processing. Booking services are intended for adults.

13. Updates

This policy may be updated to reflect changes to the website, providers or applicable law. The date of the latest update is shown on the page.