Privacy Policy

Last updated: 15/06/2026

This privacy policy describes how DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO collects, uses and protects the personal data of users of the website https://bastide-blanche.fr/, in accordance with Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended (the Data Protection Act).

It applies to any person visiting the website, completing a form, opening an account or interacting with any of its services.

1. Identity of the data controller

The data controller is:

• Company name: DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO
• Legal form: SA
• Share capital: 280 335,00 €
• Registered office: BASTIDE BLANCHE STE ANNE 367 ROUTE DES ORATOIRES 83330 LE CASTELLET
• SIRET: 422 635 177 00021
• RCS: 422 635 177 R.C.S. Le Castellet
• EU VAT number: FR16422635177
• Publication director: JULIEN BRONZO
• Contact email: contact@bastide-blanche.fr

2. Data Protection Officer (DPO)

A Data Protection Officer (DPO) has been appointed. You may contact them for any question relating to the processing of your personal data or the exercise of your rights:

• Name: Getup Agency
• Email: olivier@bastide-blanche.fr

3. Main processors (art. 28 GDPR)

To operate the website and its services, DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO engages processors acting on documented instructions and bound by a contract compliant with article 28 of the GDPR.

• Hosting provider: IONOS SARL, 7 place de la Gare, BP 70109, 57200 Sarreguemines Cedex, France, 09 70 80 89 11
• Newsletter mailing service provider: other service provider

All our processors are bound by a contract compliant with article 28 of the GDPR and provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures.

4. Purposes, legal bases and retention periods

In accordance with articles 13 and 14 of the GDPR, the processing activities carried out are as follows.

4.1 Contact form

• Data collected: identity (last name, first name), email address, message content and any information the user chooses to provide.
• Purpose: responding to requests submitted via the contact form.
• Legal basis: legitimate interest of DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO in responding to enquiries addressed to it (art. 6.1.f GDPR).
• Retention period: 3 years from the last contact with the user (CNIL recommendation — commercial management framework).

4.2 Newsletter

• Data collected: email address (and first name where provided).
• Purpose: sending commercial communications and news.
• Legal basis: free, specific, informed and unambiguous consent of the data subject (art. 6.1.a and art. 7 GDPR), collected via an opt-in mechanism (double opt-in where applicable).
• Retention period: until the user unsubscribes, or in the absence of any interaction for 3 years (CNIL recommendation).
• Unsubscription: an unsubscribe link is included in every email sent.

4.3 Orders / E-commerce

• Data collected: identity, billing and delivery addresses, telephone number, email address, order history, after-sales service exchanges.
• Purpose: performance of the sales contract, invoicing, delivery, after-sales service and compliance with legal and fiscal obligations.
• Legal basis: performance of a contract (art. 6.1.b GDPR) and compliance with legal obligations (art. 6.1.c GDPR).
• Retention periods:
  • Customer data: 5 years after the last order (civil limitation period, art. 2224 French Civil Code).
  • Invoices and accounting documents: 10 years (art. L123-22 French Commercial Code).
  • Payment data: not stored by DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO, managed directly by the payment service provider; where tokenisation is used to facilitate subsequent purchases, maximum retention of 13 months (CNIL recommendation).

4.4 Customer account

• Data collected: identity, contact details (email, telephone, addresses), browsing and order history, preferences.
• Purpose: creation and management of the customer account, personalisation of the user experience.
• Legal basis: performance of a contract (art. 6.1.b GDPR).
• Retention period: until the user requests account deletion, plus 1 year for retention of technical connection logs.

4.5 Technical security logs

• Data collected: IP address, date and time of connection, pages viewed, user agent.
• Purpose: ensuring website security, preventing and detecting fraud or intrusions, guaranteeing service availability.
• Legal basis: legitimate interest of DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO in securing its information systems (art. 6.1.f GDPR).
• Retention period: 1 year (CNIL recommendation).

5. Transfers of data outside the European Union

Certain third-party tools deployed on the website involve the transfer of personal data outside the European Economic Area.

The following tools may give rise to such a transfer:

• Google Analytics (Google LLC, United States)

These transfers are governed by the standard contractual clauses adopted by the European Commission (art. 46 GDPR) and, where applicable, by relevant adequacy decisions (including the EU-US Data Privacy Framework for certified organisations).

6. Cookies and trackers (art. 82 French Data Protection Act)

The website uses cookies and trackers. In accordance with article 82 of the French Data Protection Act and CNIL guidelines, trackers that are not strictly necessary for the website to function are only placed after the user's prior consent has been obtained.

The user may at any time:

• accept or decline trackers via the consent banner displayed on their first visit;
• change their choices or withdraw consent via the cookie management module accessible from the website;
• configure their browser to block or delete cookies already placed.

Refusing trackers has no impact on access to the website's essential content and services.

6.1 Strictly necessary technical cookies

These cookies are essential for the website to function (session management, shopping basket, security, load balancing, storage of consent choices). They are exempt from the consent requirement pursuant to article 82 of the French Data Protection Act.

6.2 Google Analytics

Google Analytics (Google Ireland Limited)

• Purpose: audience measurement and website traffic analysis.
• Legal basis: user consent (art. 82 French Data Protection Act).
• Cookie retention period: maximum 13 months (CNIL recommendation).
• Transfer outside the EU: yes, to the United States (Google LLC). Safeguards: standard contractual clauses adopted by the European Commission (art. 46 GDPR).
• Third-party policy: https://policies.google.com/privacy

7. Mandatory or optional nature of data

Fields identified as mandatory in forms (in particular those marked with an asterisk) must be completed to enable the request to be processed, an order to be executed or the relevant service to be provided. Otherwise, DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO will be unable to act on the request.

Optional fields are left to the user's discretion and allow for a more personalised response or service.

8. Automated decisions and profiling

No automated decision-making producing legal effects or significantly affecting the user, within the meaning of article 22 of the GDPR, is carried out by DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO, unless otherwise indicated in this policy.

9. Your rights

In accordance with articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

• Right of access (art. 15 GDPR): to obtain confirmation that data relating to you is being processed and to obtain a copy.
• Right of rectification (art. 16 GDPR): to have inaccurate data corrected or incomplete data completed.
• Right to erasure / right to be forgotten (art. 17 GDPR): to request deletion of your data in the cases provided for by the GDPR.
• Right to restriction of processing (art. 18 GDPR): to request suspension of processing in certain situations.
• Right to data portability (art. 20 GDPR): to receive your data in a structured, commonly used and machine-readable format, or to have it transmitted to another data controller.
• Right to object (art. 21 GDPR): to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and without grounds in the case of processing for direct marketing purposes.
• Right to withdraw consent (art. 7.3 GDPR): to withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to define post-mortem directives (art. 85 French Data Protection Act): to arrange what happens to your data after your death.

How to exercise your rights: these rights may be exercised by email to olivier@bastide-blanche.fr, or by post to: DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO, BASTIDE BLANCHE STE ANNE 367 ROUTE DES ORATOIRES 83330 LE CASTELLET.

You will receive a response within one month of receipt of the request, which may be extended by two months due to the complexity or number of requests (art. 12.3 GDPR). Exercising these rights is free of charge. Proof of identity may be requested where there is reasonable doubt as to the identity of the applicant.

10. Complaint to the CNIL

Independently of any other administrative or judicial remedy, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL — the French data protection authority):

• Address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Telephone: 01 53 73 22 22
• Online complaint form: https://www.cnil.fr/fr/plaintes
• Website: https://www.cnil.fr

11. Security (art. 32 GDPR)

DOMAINE LA BASTIDE BLANCHE — SCEA BRONZO implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 of the GDPR:

• encryption of communications via HTTPS/TLS;
• access control to information systems based on the principle of least privilege;
• password hashing using robust algorithms;
• regular data backups and restoration tests;
• logging of access and monitoring of security events;
• staff awareness and training on data protection;
• rigorous selection of processors and contractual formalisation compliant with the GDPR.

12. Amendments to this policy

This policy may be updated to reflect legal, regulatory, technical or organisational developments. Any amendment takes effect upon publication on the website.

Date of last update: 15/06/2026

This is an English translation provided for convenience. In the event of any discrepancy, the French version shall prevail.