Privacy Statement

Who is responsible

The controller of the personal data described here is Annecy74.com, being the owners of the Annecy74 penthouse together with their appointed managers. You can reach us about anything in this statement at team@annecy74.com.

We have not appointed a data protection officer, as we are not required to do so.

What we collect

What you give us

If you send an enquiry through the site, we receive the information you type into the form:

• your name;
• your email address;
• the dates you have in mind, if you give them;
• the number of adults and children in your party;
• the message you write, including any services you tick;
• the language version of the site you were using.

These are the only fields on the form. We do not ask for your address, telephone number, date of birth, identity documents or payment details, and you should not send them to us through the site. If you volunteer other information inside the free-text message, we receive it.

What your browser gives us

Like any website, ours is served by infrastructure that processes technical data in order to deliver pages and to keep the service secure and available. That includes your IP address, the page requested, the time, your approximate region, your browser and operating system, and the referring page. This data is handled by our hosting and content delivery provider.

Measurement

We use Google Analytics to count visits and to see which pages people find useful. We treat it as part of running the site, so it is active from your first request rather than something you switch on. It sets a cookie and processes your IP address (truncated before storage), the pages you view, the approximate region you are in, and basic device and browser information. It does not tell us who you are, and we make no attempt to identify anyone from it.

Legal basis: our legitimate interest in understanding how the site is used and in improving it (Article 6(1)(f) of the GDPR). We have weighed that against your interests: the data is not used to profile you, to target advertising or to make any decision about you, and it is not combined with anything else we hold. You have the right to object at any time, and practical ways to stop it are set out below.

Advertising and marketing storage is a separate matter and remains switched off unless you accept it. When you first arrive, ad storage, ad user data and ad personalisation are all set to denied, and the cookie card is what changes that. Choosing "Essential only" leaves them denied.

How to stop it

You can object to analytics at any time and by any of these means: install Google's official browser add-on for opting out of Google Analytics; block or clear cookies for this site in your browser settings; use your browser's private mode; or write to us at team@annecy74.com and we will tell you what else we can do. The site works exactly the same either way.

Google Ireland Limited acts as our processor for this, with Google LLC as a sub-processor. Data may be transferred to the United States under the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses. Google Analytics data is retained for the period configured in our account, after which it is deleted. We have not enabled Google Signals, advertising features, remarketing or data sharing for advertising purposes.

What we still do not do

We use no advertising, remarketing or profiling technologies, and we embed no social media pixels or tracking share buttons. We do not build individual profiles of visitors, and we do not sell, rent or trade personal data to anyone. There is no automated decision-making and no profiling within the meaning of Article 22 of the GDPR.

Why we use it, and on what legal basis

To answer your enquiry

We use your name, email address, dates, party size and message to reply to you and to discuss a possible stay or the services you asked about. Legal basis: steps taken at your request prior to entering into a contract, and our legitimate interest in responding to people who contact us (Article 6(1)(b) and 6(1)(f)).

To arrange a service you have asked for

If you ask about a concierge service, we may pass the relevant details to the operator concerned so that they can quote or confirm. Legal basis: steps taken at your request prior to a contract, and legitimate interest (Article 6(1)(b) and 6(1)(f)).

To translate an enquiry for the manager

The property is managed by a French-speaking manager. If your enquiry is written in a language other than French or English, an automated translation into French is produced and placed beneath your original words so that your request is understood accurately. Legal basis: legitimate interest in handling your enquiry correctly (Article 6(1)(f)).

To keep the site working and secure

Technical data is processed to deliver the site, to prevent abuse and to diagnose faults. Legal basis: legitimate interest in the security and availability of our service (Article 6(1)(f)).

To keep records and to defend claims

We may retain correspondence where necessary to keep proper records or to establish, exercise or defend legal claims. Legal basis: legitimate interest, and compliance with legal obligations (Article 6(1)(f) and 6(1)(c)).

Where we rely on legitimate interest, we have considered the effect on you and are satisfied that our interest does not override your rights and freedoms. You may object at any time — see Your rights below.

Cookies and browser storage

We use no advertising, analytics or tracking cookies, and therefore no consent banner is required. What the site does store is strictly necessary to make it work, is set only in response to something you do, and stays in your own browser:

a74lang (cookie)

Remembers the language you chose, so you are not redirected away from it on your next visit. It contains a two-letter language code and nothing else.

annecy74:lang

The same choice, kept in local storage so the site can honour it immediately.

annecy74:who

The name and email address you last sent an enquiry with, so you do not have to type them again. Saved only after a successful send. It never leaves your browser.

annecy74:want

The services you have ticked while browsing, kept for the current browsing session only so your selection survives a page reload.

annecy74:drawer-width

The width you dragged a panel to, so it opens that way next time.

annecy74:routed

A note that you have already been sent to a language once in this session, so it does not happen twice.

annecy74:consent

Your answer to the cookie card, so you are asked once rather than on every page. Strictly necessary: it is the record of your own choice.

Set on every visit

Google Analytics sets its own cookies (_ga, and a cookie beginning _ga_ followed by our property identifier). They hold a randomly generated identifier used to recognise a returning browser and to group page views into a visit, and they expire after two years. See How to stop it above if you would rather they were not set.

You can clear all of this at any time through your browser settings. The site continues to work without it; it simply forgets your preferences.

Who your information reaches

Your enquiry is read by the property manager and the owners. Beyond that, personal data is shared only with the following categories of recipient, and only so far as necessary:

The property manager

An independent management company appointed to look after the property and to correspond with guests. Enquiries are sent to the manager so that you receive a reply.

Service operators

Where you ask about a concierge service, the independent operator of that service, so that they can quote or confirm. Each operator is a controller in its own right for what it then does with your details.

Our hosting and cloud provider

Amazon Web Services, which hosts the site, delivers it through a content delivery network, sends and receives our email, and provides the automated translation described above. It acts as our processor under a data processing agreement.

Google (analytics)

Google Ireland Limited processes the analytics data described above as our processor.

Booking platforms

If you follow a link from the site to a booking platform, anything you then enter is collected by that platform under its own privacy policy. We do not pass your details to them.

A scheduling tool

If you choose to book a call, the scheduling page is operated by a third party under its own privacy policy.

Professional advisers and authorities

Where we are required to disclose by law, or where necessary to establish, exercise or defend legal claims.

We do not sell personal data, and we do not share it for anyone else's marketing.

Where your information is held

Our website, our email and the automated translation are hosted in the European Union, in Amazon Web Services regions in France and Ireland. Content is delivered through a global network of edge locations, which means the technical request data described above may be processed at an edge location outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, that transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses together with supplementary measures, as required by Chapter V of the GDPR. You may ask us for details.

How long we keep it

Enquiries that do not lead to a booking

Kept for up to three years from our last contact with you, which is the period the French data protection authority regards as reasonable for a commercial prospect, and then deleted.

Enquiries that lead to a booking

Kept for the duration of the stay and then for as long as necessary to meet accounting and legal obligations and to defend claims.

Technical logs

Kept for a short period for security and diagnostics, in line with our provider's standard retention.

Browser storage

Stays in your browser until you clear it. The session entry is discarded when you close the tab.

How we protect it

The site is served only over an encrypted connection. Enquiries are transmitted over TLS and are handled by managed cloud services with access restricted to the people who need it. We do not operate a database of visitors, and the site holds no accounts and no passwords.

No transmission over the internet can be guaranteed to be completely secure. Please do not send us sensitive information, payment details or identity documents through the site.

Your rights

Under the GDPR you have the right to:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have data deleted where there is no good reason for us to keep it (erasure);
• ask us to restrict processing while a question about it is resolved (restriction);
• receive the data you gave us in a portable, machine-readable form (portability);
• object to processing carried out on the basis of legitimate interest, including at any time and for reasons relating to your particular situation (objection);
• withdraw consent at any time, where we have relied on consent, without affecting processing already carried out;
• give directions as to what happens to your data after your death, as provided by French law.

To exercise any of these, write to team@annecy74.com. We will respond within one month, and will tell you if we need longer because a request is complex. We may need to verify your identity before acting, and we may be unable to erase data we are required to keep.

Complaints

If you are not satisfied with how we have handled your data, you may complain to the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or to the supervisory authority in your own country of residence. We would be glad to hear from you first.

Children

The site is aimed at adults arranging a stay. We do not knowingly collect personal data from children. Where a booking party includes children, we receive only the number of children, not their names or any detail about them, unless you choose to tell us.

Changes to this statement

We may update this statement. The version in force is the one published here, and the date it was last updated is shown at the top of this page. Where a change is significant we will make that clear.