Privacy policy

This is a translation provided for information only. In case of any discrepancy, the French version of this privacy policy prevails.

Last updated: 9 November 2026

1. Data controller

The Las Coussoulesses website is published by Marie-Pierre Flahaut EI (sole proprietorship), which runs the Las Coussoulesses holiday cottages and guest rooms:
339 route de Montaigu, 47370 Anthé, France
SIRET: 990 769 010 00010 — RCS Agen 990 769 010 — RM 990 769 010 47
E-mail: lascoussoulesses@gmail.com — Phone: +33 6 86 20 33 69

For any question about your personal data, you can write to us at lascoussoulesses@gmail.com or at the postal address above.

2. Data we collect

Depending on how you use the website, we collect:

  • Identity and contact details: last name, first name, postal address, e-mail address, phone number, date of birth
  • Nationality and, for guests of foreign nationality only, place of birth (required to fill in the individual police registration form provided for by article R. 611-42 of the French code on the entry and residence of foreigners and the right of asylum)
  • Booking data: accommodation, dates of stay, number of guests (adults and age of children), options chosen (meals), amount paid, payment and refund history
  • Account data (if you create one): e-mail address, password (stored in encrypted form, never in plain text)
  • Messages you send us (contact form, problem report)
  • Technical data: IP address, browser type, pages viewed and connection logs, used for the security and proper functioning of the website

Your postal address and date of birth are used to draw up the holiday rental agreement and the invoice; they are also required by the French regulations applicable to furnished tourist accommodation.

We do not collect any bank card data: payment details are entered and processed directly by our payment provider, Stripe.

3. Purposes and legal basis

  • Managing bookings (booking, payment, rental agreement, invoice, any refund) — performance of the contract (art. 6.1.b GDPR)
  • Individual police registration form (guests of foreign nationality) — legal obligation (art. 6.1.c GDPR, art. R. 611-42 of the French CESEDA)
  • Accounting and invoicing (keeping invoices and credit notes) — legal obligation (art. 6.1.c GDPR)
  • Creating and managing your customer account — performance of the contract
  • E-mails about your booking (confirmation, payment link, reminders, cancellation) — performance of the contract
  • Answering your messages — legitimate interest (art. 6.1.f GDPR)
  • Website security (preventing fraud and unauthorised access) — legitimate interest

We do not use your data for direct marketing and do not subscribe you to any newsletter without your consent.

4. Recipients of your data

Your data is intended for the operator, Marie-Pierre Flahaut. It is shared only with the providers needed to run the service:

  • OVHcloud (France) — hosting of the website, the database and the document archive (rental agreements, invoices, credit notes, police registration forms), and sending of e-mails; data hosted in France
  • Stripe — secure processing of payments and refunds
  • Google Fonts — display of the website's fonts (your IP address is sent to Google when pages load)

The booking platforms with which our calendars are synchronised only receive the unavailable dates, without any personal data.

Some of these providers (Stripe, Google) may process data outside the European Union, in particular in the United States; these transfers are governed by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses. Police registration forms may be passed on to the police or gendarmerie at their request, as required by law. We neither sell nor rent your data to third parties.

5. Retention periods

  • Invoices and credit notes: 10 years from the end of the financial year (article L. 123-22 of the French Commercial Code)
  • Rental agreements and booking data: for the duration of the contractual relationship, then 5 years as evidence (general limitation period)
  • Individual police registration forms: 6 months (article R. 611-42 of the CESEDA)
  • Customer account: as long as the account is active; deleted or anonymised 3 years after your last activity, or earlier on simple request (subject to the documents we are legally required to keep)
  • Messages: for the time needed to handle your request, then 3 years at most
  • Technical logs: 12 months at most

6. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to give instructions on what happens to it after your death. You can view and change your information from your customer account, or exercise these rights by writing to lascoussoulesses@gmail.com. We will reply within one month.

If, after contacting us, you believe that your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country of residence.

7. Cookies

This website only uses cookies that are strictly necessary for it to work: keeping your session and your login to your account, and the content of your booking in progress. Stripe's payment page sets its own cookies, needed for payment security and fraud prevention. No audience measurement or advertising cookies are used; these cookies therefore do not require your consent.

8. Security

We take appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS) across the whole website, passwords stored in encrypted form, payments processed exclusively by Stripe (PCI-DSS certified), and access to the management area and to the document archive restricted to the operator and password-protected.

9. Changes to this policy

This policy may be updated, in particular if the website or the regulations change. The date of the last update is shown at the top of this page.

Back to top