Privacy Policy

1. Data controller

The controller for data collected via the Site is SARL MARTHILOY, the company operating the Château de Tilloloy (see the Legal Notice for its full identification — SIREN, RCS, registered office), reachable at the details shown at the bottom of this page.

2. Data collected

The Site has no online contact form and no newsletter sign-up: no data is therefore automatically collected through such means.

When a visitor contacts the Château by phone or email (for example, to request a quote for hiring the venue, or to ask about room capacities or partners), the following data may be collected:

• identity (first name, last name);
• contact details (email address, phone number);
• information about the envisaged event (desired date, number of guests, message);
• more generally, any information the visitor chooses to share in their message.

A technical administration area, reserved for the Site's managers, allows content (text, photos, events) to be updated. Access is protected by a password and a session cookie; it collects no data about Site visitors.

3. Purposes and legal bases

Data sent by email or phone is used to respond to the visitor's request, prepare a quote and, where applicable, follow up on a booking (legal basis: pre-contractual steps taken at the data subject's request, and the operator's legitimate interest in handling client enquiries — article 6.1.b and 6.1.f GDPR).

Technical data strictly necessary for the operation and security of the Site (the administration area's session cookie) is processed on the basis of the operator's legitimate interest in maintaining the security of its information system.

4. Recipients of data

Collected data is intended for the Château's operator and is never sold or rented to third parties for commercial purposes.

The partner service providers featured in the Site's directory (caterers, accommodation, photographers, DJs, florists, etc.) are independent businesses; their contact details are shared with visitors for information purposes only, and no personal data is automatically transmitted to these partners by the Château. Any direct contact between a client and a partner is made solely on the client's own initiative.

The Site relies on the following technical providers for hosting and operation, acting as processors within the meaning of the GDPR: Vercel Inc. (site and image hosting) and Neon (database). These providers only access data to the extent necessary to provide their technical services.

5. Transfers outside the European Union

The technical providers mentioned in section 4 may process or store data on infrastructure located outside the European Union, including in the United States. Where this occurs, such transfers are governed by the appropriate safeguards provided for by the GDPR (European Commission standard contractual clauses or an equivalent mechanism).

6. Retention period

Data exchanged during a quote request or booking is kept for as long as necessary to handle the request and perform any resulting rental contract, then for the duration of the applicable statutory limitation periods (contractual warranties, accounting obligations).

Where a contact request is not followed up, the data is kept for a maximum of 3 years from the last exchange, in line with the French data protection authority's (CNIL) recommendations on commercial prospecting.

7. Cookies

The public Site (pages presenting the Château, its events and its partners) does not set any audience-measurement, advertising or tracking cookies.

A strictly necessary session cookie ("admin_session") is used solely to secure the login of persons authorised to manage the Site's content; this cookie is never set on an ordinary visitor's device.

Videos embedded on the Site use YouTube's "youtube-nocookie.com" mode, which does not set a tracking cookie unless the visitor voluntarily interacts with the video player.

8. Security

The operator implements reasonable technical and organisational measures to protect the data processed: encrypted connection to the Site (HTTPS), administration-area passwords stored in hashed form, and signed session tokens with a limited lifetime.

9. Rights of data subjects

In accordance with applicable regulations, every individual has a right of access, rectification, erasure and restriction of processing of their data, as well as a right to portability and a right to object on legitimate grounds.

These rights may be exercised by writing to the email address shown at the bottom of this page, specifying the purpose of the request and, where necessary, enclosing proof of identity.

Every individual also has the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr — if they consider that the processing of their data does not comply with the regulations.

10. Minors

The Site is not intended for minors, and the operator does not knowingly collect data relating to minors without the consent of their legal representatives.

11. Changes to this Privacy Policy

This Privacy Policy may be updated, in particular to reflect legal, regulatory or technical developments. The date of the last update is shown at the top of this page.