Privacy Policy

Last updated: 9 October 2026

This English version is provided for information only. In the event of any discrepancy, the French version prevails and is the only legally binding version.

PREAMBLE

Terms beginning with a capital letter are defined in, and have the same meaning as those used in, the Terms of Service.

In the course of providing the Services offered through the Site, the Publisher will process personal data (hereinafter “Personal Data”); accordingly, it undertakes to respect the privacy of its Users and to process Personal Data confidentially. This Personal Data is collected in accordance with the provisions of European Regulation (EU) 2016/679 on the protection of personal data (General Data Protection Regulation, “GDPR”) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (the “Loi Informatique et Libertés”). The terms defined in Article 4 of the GDPR apply to this GDPR Policy and are themselves written with an initial capital letter. The Publisher acts as “Controller” and is referred to as such hereinafter.

As a reminder, Personal Data means any information relating to “a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (an identified or identifiable natural person).

Article 1 – PURPOSE

The purpose of this GDPR Policy is to provide information, on the one hand, on how the Controller collects and processes Users' Personal Data and, on the other hand, on the means available to those Users to control such use and to exercise the rights relating to it.

By using the Site, the User confirms that they have read and understood this GDPR Policy and accepts its terms.

This GDPR Policy may be updated. In the event of significant changes to this policy, the User will be required to give clear consent to those changes; failing that, the User must stop using the Site.

Article 2 – PERSONAL DATA COLLECTED AND PROCESSED IN CONNECTION WITH BROWSING THE SITE

Article 2.1 – Personal Data collected

The Personal Data collected in connection with Users' activity is as follows:

–Identification data: surnames, first names, title, date of birth, email address, telephone number;
–Encrypted username and password used to identify the User on the Site;
–Information relating to the history of the commercial relationship with the Publisher: subscriptions taken out, orders for products and services and, where applicable, invoicing and payment;
–Requests made to customer service or incidents reported, for example concerning the performance of the services;
–Any other information that the User has chosen to bring to the Publisher's attention,
–Identifiers of the device used (your computer's IP address, Android ID, Apple ID, etc.), type of operating system (Microsoft Windows, Apple OS, Linux, Unix, BeOS, etc.) and type and version of the browser software used by the device (Microsoft Internet Explorer, Apple Safari, Mozilla Firefox, Google Chrome, etc.), dates and times of connection to the Site, address of the referring web page (“referrer”) and browsing data on the Site, content viewed. The Publisher may also use standard Internet technologies such as scripts, pixels and redirects.

Personal Data that is essential for the provision of the Services is marked with an asterisk.

Article 2.2 – Legal basis, purpose of collection and processing, and retention period of Personal Data

Providing the Site's Services via the User's Account

Legal basis: Performance of the Terms of Service as accepted by the User

Retention: Personal Data is retained for the entire lifetime of the Account. When the Account is deleted, the Personal Data that identifies the User (name, email address, telephone number, address, password) is anonymised; the content the User has shared within a House (past stays, expenses, notes) is retained there in anonymised form in order to preserve the history and accounts of the House's other Users. If an Account has been inactive for 2 years, the Personal Data will be deleted if the User does not respond to a reactivation email. In addition, Personal Data may be archived for evidential purposes for a period of 5 years.

Processing Subscription orders and carrying out User management operations relating to orders, invoices, loyalty programmes and the monitoring of the contractual relationship with Users

Legal basis: Performance of the orders and subscriptions entered into by the User with the Controller

Retention: Personal Data is retained for the entire duration of the contractual relationship. Invoices are archived for a period of 10 years. In addition, Personal Data (with the exception of bank details) is archived for evidential purposes for a period of 5 years. Payment card data is retained by the payment service provider Stripe until the last payment instalment due under the Subscription and in order to comply with its legal and regulatory retention obligations.

Building a customer and prospect database

Legal basis: Legitimate interest of the Controller in developing and promoting its business

Retention: For Users: Personal Data is retained for the entire duration of the contractual relationship. For prospects: Personal Data is retained for a period of 3 years from the last contact, for prospecting purposes.

Sending newsletters, solicitations and promotional messages to Users

Legal basis: Legitimate interest of the Controller in building loyalty and keeping Users informed of its latest news

Retention: Personal Data is retained for 3 years from the last contact with the Controller.

Sending newsletters, solicitations and promotional messages to prospects

Legal basis: Non-business prospects: consent given by ticking a box. Business prospects: legitimate interest of the Controller in building the loyalty of its prospects and keeping them informed of its latest news

Retention: Data is retained for 3 years from the Prospect's last contact with the Controller or until consent is withdrawn.

Responding to requests for information and support

Legal basis: Legitimate interest of the Controller in responding to requests

Retention: Personal Data is retained for the time needed to handle the request and deleted once the request has been handled.

Managing requests to exercise rights

Legal basis: Legitimate interest of the Controller in responding to requests and keeping a record of them

Retention: If proof of identity is requested: it will be kept only for the time needed to verify identity. Once verification has been carried out, the proof of identity is deleted. Where the right to object to receiving marketing communications is exercised: this information will be kept for 3 years.

Improving Users' experience on the Site

Legal basis: Legitimate interest of the Controller in improving its Users' experience on the Site

Retention: Personal Data is retained for the time needed to carry out the intended improvement.

Article 2.3 – Recipients of Personal Data

The recipients of Personal Data are:

(i)The Publisher's staff;
(ii)
Its processors, namely:
- –Site hosting: Interface: Vercel Inc. – 340 S Lemon Ave #4133 Walnut, CA 91789 – privacy@vercel.com
- –Server hosting: Google Cloud Platform (Google Cloud France) – 8 rue de Londres – 75009 Paris, France – Google Cloud France Privacy Policy.
- –Server hosting: Amazon Web Services, Services EMEA SARL 38 AV JOHN F KENNEDY L 1855 99137 LUXEMBOURG – http://aws.amazon.com
- –Payment provider: Stripe, 10 Boulevard Haussmann 75009 Paris – Stripe Privacy Policy.
- –Analytics solution: Mixpanel, Avenida Diagonal, 442 – P. 3 PTA. 1 08037, Barcelona, Spain – Mixpanel Privacy Policy
- –Analytics solution: Hotjar – Dragonara Business Centre 5th Floor Dragonara Road Paceville St Julian's STJ 3141 Malta – Hotjar Privacy Policy
- –Audience analytics solution: Vercel Web Analytics & Speed Insight – Vercel Inc. – 340 S Lemon Ave #4133 Walnut, CA 91789 – Vercel Privacy Policy
- –Error tracking and performance monitoring solution: Sentry – Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105 – Sentry Privacy Policy
- –Customer service (after-sales support) solution: Crisp – IM SAS, 2 boulevard de Launay, 44100 Nantes – Crisp Privacy Policy
(iii)Where applicable: public and private bodies, solely in order to comply with the Publisher's legal obligations.

Article 2.4 – “Cookies” policy

A cookie is a text file placed on the user's computer or mobile device when they view a website, an application or an online advertisement, and stored in a specific area of its hard drive. Cookies are managed by the web browser, and only the issuer of a cookie can decide whether the information it contains is read or modified.

A cookie has a limited period of validity. It is placed and stored on the user's device in compliance with applicable law and subject to the choices expressed by the user, which the user may change at any time under the conditions set out in Article 4 below.

A cookie does not personally identify a user. It enables its issuer to recognise the user's device and to collect certain information about the browsing carried out from that device.

Cookies have several functions, such as enabling efficient navigation on a website or application, remembering the user's choices and offering them relevant advertising content based on the interests expressed while browsing. Further information about cookies is available on the following website (CNIL, the French data protection authority): www.cnil.fr

Subject to the choices made by the User, the cookies placed by the Publisher serve the following purposes:

–Operating and optimising navigation on the Site/application;
–Adapting the presentation of the Site and applications to the display preferences of the device (language used, display resolution, operating system, etc.) during visits, depending on the viewing or reading hardware and software on the device;
–Storing information relating to a form completed by the User on the Site (registration or access to the Account) or to products, services or information selected on the Site (service subscribed to, content viewed, purchase made, etc.);
–Automatic login to reserved or personal areas of the Site, such as the Account, using previously provided identifiers or data;
–Providing tools for sharing on social networks;
–Managing and carrying out internal technical operations for troubleshooting, data analysis, testing, research, analyses, studies and surveys;
–Implementing security measures;
–Quality measurements to ensure that content is displayed in a way suited to the User's device.

Article 2.5 – Transfers outside the European Union

Your data is retained and stored for the entire duration of the processing on the servers of Google Cloud Platform (Google Cloud France) – 8 rue de Londres – 75009 Paris, France.

In connection with the tools used (see Article 2.3), Personal Data may be transferred outside the European Union. Transfers of Personal Data in this context are secured by the following means:

–either the Personal Data is transferred to a country that is the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the GDPR: in that case, that country ensures a level of protection deemed sufficient and adequate with regard to the provisions of the GDPR;
–or the data is transferred to a country whose level of data protection has not been recognised as adequate under the GDPR: in that case, such transfers are based on the appropriate safeguards set out in Article 46 of the GDPR, adapted to each provider, including, without limitation, the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules or an approved certification mechanism.
–or the data is transferred on the basis of one of the appropriate safeguards described in Chapter V of the GDPR.

Article 3 – DATA CONTROLLER

The Controller is TECHNOMATE, a French simplified joint-stock company with a single shareholder (SASU) with share capital of 500 euros, registered with the Saint-Malo Trade and Companies Register (R.C.S.) under number 948 428 248, whose registered office is located at 13 Rue Hippolyte de la Morvonnais, 35400 Saint-Malo, France, represented by Guillaume Chantreau, duly authorised.

The Controller can be contacted as follows:

–By post at: 13 Rue Hippolyte de la Morvonnais, 35400 Saint-Malo, France
–By telephone on 09 83 21 09 66
–By email: contact@cazmate.com

Article 4 – THE USER'S RIGHTS OVER THEIR PERSONAL DATA

Every User may exercise the following rights, pursuant to European Regulation 2016/679 and the French Data Protection Act (Loi Informatique et Libertés, Law No. 78-17 of 6 January 1978):

–Right to information (Articles 13 and 14 GDPR);
–Right of access, right to rectification and right to erasure of data (Articles 15, 16 and 17 GDPR);
–Right to data portability (Article 20 GDPR);
–Right to restriction of processing (Article 18 GDPR) and right to object to the processing of data (Article 21 GDPR);
–Right to withdraw consent at any time (Article 7 GDPR);
–Right not to be subject to a decision based solely on automated processing;
–Right to give instructions regarding what happens to the data after death;
–Right to lodge a complaint with the competent supervisory authority (Article 77 GDPR).

To exercise these rights, the User must contact the Controller using the contact details given in Article 3 above.

In order for the Controller to be able to respond to the request, the User may be required to provide certain information such as: their surname and first name(s), their email address and their account, personal area or subscriber number.

Visit www.cnil.fr (the website of the CNIL, the French data protection authority) for more information about your rights.

Article 5 – CONDITIONS FOR AMENDING THE PRIVACY POLICY

The Publisher of the Cazmate Site reserves the right to amend this Policy at any time in order to comply with any regulatory, case-law, editorial or technical developments.

Such amendments will apply from the effective date of the amended version. The user is therefore invited to consult the latest version of this policy regularly. Nevertheless, the Publisher will keep Users informed of any significant amendment to this GDPR Policy.

This GDPR Policy was issued on 12 January 2026.