Privacy policy
How CASAMAZA collects, uses and protects your personal data (GDPR) on casamaza.fr. Last updated: 30 October 2026.
CASAMAZA protects your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
1. Data controller
CASAMAZA, SASU, registered office in 95300 Pontoise, France, SIREN 909 328 494. Contact for any question or request: contact@casamaza.fr.
2. Data collected, purposes and legal bases
| Situation | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Booking | Last name, first name, email, phone, dates, number of guests, nationality and address if requested, messages about the stay | Manage the booking and the stay, send the access code | Performance of the contract | Duration of the stay, then 5 years (civil limitation period) |
| Payment and deposit | Card data (processed by Stripe, never stored by CASAMAZA), amount, payment status | Collect payment for the stay, place the deposit pre-authorisation | Performance of the contract | Invoices: 10 years (accounting obligation) |
| Contact form | Last name, first name, email, message | Reply to your request | Legitimate interest | 3 years after the last exchange |
| WhatsApp button | Your number and the content of the message, only if you click | Reply to you | Your request | According to WhatsApp, then 3 years at CASAMAZA |
| Browsing | IP address, browser type, security logs | Secure the site, prevent abuse | Legitimate interest | 12 months maximum |
We do not sell your data. We do not carry out profiling or unsolicited marketing.
For payments by bank transfer, we keep the transfer receipt (payer’s name, amount, date) for 10 years, in line with accounting obligations.
3. Recipients
Your data is accessible only to CASAMAZA staff who need it and to the following providers, for the purposes above only.
| Provider | Role | Data concerned |
|---|---|---|
| Superhote | Booking engine and stay management | Booking data |
| Stripe | Secure payment and deposit pre-authorisation | Payment data |
| o2switch | Hosting of the site | Site data |
| Proton AG (Proton Mail) | Email service | Emails exchanged with you |
| WhatsApp (Meta) | Messaging, if you use the button | Number and message |
| Google (maps) | Display of a map in the booking engine | IP address |
Your data may also be disclosed to an authority where the law requires it.
4. Transfers outside the European Union
Some providers (notably Stripe, Google and Meta) may process data outside the European Union. These transfers are covered by the safeguards provided by the GDPR (standard contractual clauses or an adequacy decision).
Our emails are hosted by Proton AG in Switzerland, a country recognised by the European Commission as providing an adequate level of protection.
5. Cookies
The site uses only strictly necessary cookies, which do not require consent: remembering the chosen language and site security. It uses no advertising cookies. It uses Matomo, an audience-measurement tool hosted on our own servers in France, configured without cookies, with anonymised IP addresses, without cross-referencing other data and without sharing it with third parties. These anonymous statistics are used only to understand how the site is used (legitimate interest; audience measurement exempt from consent under CNIL guidelines). Detailed visit data is deleted after 6 months. Your browser’s “Do Not Track” signal is honoured, and you can object to this measurement at any time: manage my opt-out from audience measurement. The booking module (Superhote), payment (Stripe) and map (Google) may set their own cookies when you use them, under their own policies. You can block cookies in your browser, which may limit some functions.
The booking module (Superhote) also loads technical third-party services: Stripe (secure payment and fraud prevention), Google Maps (maps of the apartments) and Google Fonts (typefaces). It stores two display preferences in your browser (language and list display mode), with no tracking or advertising use. No analytics tool or advertising cookie is used in this module.
6. Your rights
You may request access, rectification, erasure, restriction, objection or portability of your data, and set directives for its fate after your death. Write to contact@casamaza.fr; we reply within one month, and we may ask for proof of identity. In case of difficulty you may contact the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
7. Security
The site uses HTTPS. Access to the administration area is protected, a firewall monitors attacks, and backups are limited to authorised persons. In case of a data breach presenting a risk to you, we inform you and notify the CNIL within 72 hours.
8. Minors
Bookings are reserved for adults. We do not knowingly collect data from minors without the consent of their legal representative.
9. Changes to this policy
This policy may be updated. The date at the top of the page shows the latest version.