Personal data

Privacy Policy

Last updated: 24 September 2026

Translation notice. This translation is provided for convenience and may have been prepared with automated translation tools before review. In the event of any discrepancy, the French version prevails, subject to any mandatory law applicable to you.

This policy describes the processing of personal data connected with the website appart-pau.com, direct bookings and stays at Les Terrasses d’Étigny. It supplements the information provided when booking and through the cookie consent banner.

1. Data controller

The controller is LTE, the company operating under the name “Les Terrasses d’Étigny”. Its legal details and postal address are set out in the French legal notice.

For any privacy question or request: data@appart-pau.com. LTE has not appointed a Data Protection Officer; requests are handled directly by the company.

2. Data that may be processed

Depending on how you use the services, LTE may process:

• your name and contact details;
• stay dates, the apartment selected, number of guests, special requests and booking correspondence;
• information needed for payment, invoicing, tourist tax and accounting, without LTE retaining the full bank card number or security code;
• technical data strictly needed for operation and security, such as IP address, date, time, requested page and error or security logs;
• your cookie choices and, only after consent where required, audience measurement data;
• images recorded in outdoor, access and parking areas covered by video surveillance.

LTE does not request sensitive data for an ordinary booking. If you voluntarily provide health or accessibility information, it is used only to answer your request and prepare your stay.

3. Purposes and legal bases

• Enquiries and preparation of a booking: steps taken at your request before entering into a contract.
• Booking, payment, arrival, stay management and after-stay service: performance of the contract.
• Invoices, accounts and tourist tax: compliance with legal obligations.
• Website security, prevention of abuse, fraud and technical incidents: LTE’s legitimate interest in protecting its activities and systems.
• Safety of people, access points, parking areas and property: LTE’s legitimate interest pursued by video surveillance.
• Audience measurement and non-essential services: your consent where required.
• Establishment, exercise or defence of legal claims: LTE’s legitimate interest and, where applicable, compliance with a legal obligation.

No decision producing legal effects concerning you is made solely by automated means.

4. Recipients and service providers

Data may be accessed by LTE and, only as needed for their role, by its technical or contractual providers, including:

• o2switch for hosting, email, technical security and backups;
• Beds24 for the booking engine and stay management, together with connected pricing tools where needed;
• Stripe or PayPal, depending on the payment method selected;
• Google for forwarded email and, after consent, audience measurement through Google Analytics and Site Kit;
• hCaptcha to limit automated or abusive form submissions;
• maintenance, backup or security providers acting under LTE’s instructions.

Data may also be disclosed to an authority, administration, insurer, adviser or court where required by law or justified by an incident or dispute. LTE does not sell or rent personal data.

5. Transfers outside the European Economic Area

Some international providers may process data outside the European Economic Area. Where this occurs, the transfer relies on a mechanism recognised by applicable law, such as an adequacy decision or standard contractual clauses, according to the safeguards announced by the provider.

6. Retention periods

• Enquiry without booking: for the time needed to reply, then no more than twelve months after the last useful exchange.
• Booking file and contractual exchanges: during the contract, then for up to five years where needed as evidence, to handle a complaint or defend legal rights.
• Accounts and invoices: ten years where required by law.
• Payment data: according to the periods applied by Stripe or PayPal. LTE does not retain full card details.
• User-level audience measurement data: no more than fourteen months in Google Analytics, where you consented.
• Technical and security logs: generally thirty days, unless an incident, evidential need or legal duty justifies a limited longer period.
• Consent choices: for the period needed to remember and demonstrate your choice under the consent manager settings.
• Backups: for the provider’s technical rotation cycle, until automatically replaced or deleted.
• Video surveillance images: no more than fourteen days, followed by automatic overwriting. Images needed for an incident may be extracted and kept for the time needed to handle the relevant case or proceedings.

7. Cookies and audience measurement

Trackers strictly required for operation, security, language selection or remembering your choices may be used without consent where the legal conditions are met. Google Analytics and other non-essential services are enabled only after your agreement where required.

You may accept, refuse or change your choice at any time through the “Manage consent” button. The table supplied by the consent manager lists the services, purposes and durations detected on the site.

8. Video surveillance of access and parking areas

Four cameras cover outdoor areas, access points and parking areas to help protect people and property, prevent intrusions, theft or damage and, where necessary, establish the circumstances of an incident. They do not film inside the apartments.

Images are recorded locally and automatically overwritten within no more than fourteen days. Access is restricted to the authorised LTE manager. Images are disclosed only to authorities, an insurer, an adviser or a court where justified by an incident. Signs at the entrance to the monitored area provide additional information.

9. Your rights

Subject to the conditions laid down by law, you may request access to, correction or deletion of your data, restriction of processing, object to processing based on legitimate interests, request portability where it applies and withdraw consent at any time for processing based on consent.

Send requests to data@appart-pau.com. Proof of identity is requested only where there is reasonable doubt about the requester’s identity. You may also lodge a complaint with the French data protection authority (CNIL).

10. Required information

Information identified as necessary for a booking, payment or invoice must be provided so that the service can be performed. Without it, LTE may be unable to respond or confirm the booking. Non-essential cookies remain optional and refusing them does not prevent a booking.

11. Security

LTE and its providers implement technical and organisational measures proportionate to the risks, including access restrictions, encrypted communications, strong authentication, backups and component updates. As no online service can guarantee absolute security, these measures are reviewed according to the risks and reasonably available resources.

12. Updates

This policy may be amended when services, providers or applicable duties change. The current version is the one published on the site on the date shown above.

Read the authoritative French version