Privacy Policy

Last updated: 15 September 2026

This policy explains what data we process, why, who it is shared with and how to exercise your rights.

Data controller

Data we collect

We process the following data:

• Identity: surname and first name
• Contact details: email, telephone
• Booking: date, time, number of guests, special requests
• Audience: aggregated statistics (Vercel Analytics), with no cookie and no IP address retained
• Map: if you accept it, Google receives your IP address and sets its cookies

Purposes

Your data is used to:

• Handle your bookings and contact you to confirm
• Answer your questions
• Measure site traffic without identifying you
• Protect the site against abuse

Legal bases

Each processing activity rests on a distinct basis:

• Bookings: pre-contractual measures taken at your request (art. 6.1.b)
• Google Maps embed: your consent, revocable at any time (art. 6.1.a and art. 82 of the French Data Protection Act)
• Anonymous audience measurement: our legitimate interest (art. 6.1.f)
• Site security: our legitimate interest (art. 6.1.f)

Retention

Bookings: 3 years after your last interaction. Statistics: aggregated, non-identifying. Cookie choice: 6 months.

Recipients

We never sell your data and never use it for advertising. Besides restaurant staff, only these processors have access:

• DISH Digital Solutions GmbH (Germany) — booking module
• Vercel Inc. (United States) — hosting and audience measurement
• Google Ireland Limited — map, only with your consent
• Sanity AS (Norway) — content management, no visitor data

Transfers outside the EU

Hosting (Vercel) and the map (Google) involve transfers to the United States, governed by the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework. Copy of the safeguards on request.

Your rights

You have the following rights:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: request its deletion
• Restriction: suspend its processing
• Portability: receive it in a structured format
• Objection: object to the processing
• Withdraw consent at any time, without retroactive effect
• Set directives on what happens to your data after your death (art. 85 of the French Data Protection Act)

To exercise them: contact@auptitbonheur.org or by post to the restaurant. We reply within one month. You may also contact the CNIL (www.cnil.fr).

Cookies and trackers

No advertising or behavioural tracking cookies. Full list:

• NEXT_LOCALE — language selected. Necessary, exempt from consent. 1 year
• cookie-consent — your choice about the map. 6 months
• Vercel Analytics — aggregated audience, no cookie and no IP address retained. Exempt from consent
• Google Maps — Google cookies and IP address, only with your consent

Changeable at any time via “Manage cookies” at the bottom of the page.

Security

The site uses HTTPS and a content security policy restricting external resources, together with appropriate technical and organisational measures.

Additional information

Changes

Any change is published on this page, with the date above updated accordingly.