1. About this privacy notice
This privacy statement describes what personal data S.A.S De Vries De Smet processes, why we do so, how we protect it, and what rights you have. We handle personal data with care and in accordance with the General Data Protection Regulation (GDPR) and the GDPR Implementation Act.
Last updated on 9 september 2026. We may amend this statement; the most up-to-date version can always be found on this page.
2. Who is the data controller?
S.A.S De Vries De Smet is the data controller within the meaning of the GDPR for the personal data collected via this website, our services and our communications.
- SIRET
- 94492325900021
- VAT number
- FR79944923259
- Registered office
- L'Aiguebelle, lieu-dit Le Cantonnet Bas 48320, Ispagnac, Frankrijk
- campingdelaiguebelle@gmail.com
- Telephone
- +33 6 75 14 65 98
3. What personal data do we process?
For guests who make a booking, we process: name, address, email address, telephone number, number of people, dates of stay and — where applicable — identification details for the tourist tax register.
In addition, when you use our website, certain data is collected automatically: IP address, browser type, device type and information about your use of the site. This data is necessary for the website to function and to prevent misuse.
4. For what purpose and on what legal basis?
We process personal data for the following purposes:
- Performance of the contract — providing the services purchased, customer contact, support, invoicing.
- Legal obligation — statutory retention period for tax purposes (7 years) and other administrative obligations.
- Legitimate interest — securing our systems, fraud prevention, improving our services.
- Consent — when you sign up for communications or give consent for specific processing activities.
We do not process special categories of personal data (such as health, religion or political affiliation), unless you provide them to us of your own accord and they are necessary for the service.
5. How long do we retain your data?
We do not retain personal data for longer than is necessary for the purpose for which it was collected, or for as long as a statutory retention obligation requires:
| Category | Retention period |
|---|---|
| Customer file & communication | Duration of contract + 2 years |
| Invoicing and administration | 7 years (tax retention obligation) |
| Contact form submissions | Up to 2 years after last contact |
| Website logs (security) | Up to 6 months |
| Emails from job applicants | Up to 4 weeks after completion (unless consent to retain has been given) |
6. With which third parties do we share data?
We share personal data exclusively with data processors who help us to provide our service. A data processing agreement has been concluded with each data processor, setting out the protection of your data.
| Data processor | Purpose | Location / safeguards |
|---|---|---|
| Velify Software Development | Website hosting + technical maintenance | EU — Frankfurt (Supabase) + Vercel Edge · DPA via the Velify platform |
| Vercel Inc. | Hosting and CDN | United States, with EU edge nodes · DPA + Standard Contractual Clauses (SCC) |
| Supabase Inc. | Database for bookings + contact form | EU — Frankfurt · DPA available, processing within the EU |
| Resend Inc. | Sending emails (confirmation + newsletter) | United States · DPA + SCC |
We do not sell personal data to third parties. Data transfers to countries outside the European Economic Area take place only on the basis of the European Commission’s Standard Contractual Clauses (SCCs) or another appropriate transfer mechanism.
7. Security
We have implemented appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access:
- TLS encryption (HTTPS) on all our traffic
- Database encryption at rest (AES-256)
- Row-level security so that customers can only view their own data
- HMAC-signed session cookies
- Restricted access (least privilege) for our team, with audit logging
- Regular updates to our software dependencies
Should a data breach occur despite our measures, we will report this to the Dutch Data Protection Authority within 72 hours and — where required by law — to the data subjects themselves.
8. Your rights
Under the GDPR, you have the following rights:
- Right of access
- You may request details of the personal data we process about you.
- Rectification
- You may ask us to correct any inaccurate or incomplete data.
- Erasure
- You may request that we erase your data when it is no longer necessary or if you withdraw your consent.
- Restriction
- You may request that processing be temporarily restricted, for example whilst a request for correction is being processed.
- Portability
- You may receive your data in a structured digital format for transfer to another party.
- Objection
- You may object to processing on the grounds of legitimate interest or direct marketing.
- Withdrawal of consent
- Where processing is based on consent, you may withdraw your consent at any time without this rendering any previous processing unlawful.
Would you like to exercise a right? Please send an email to campingdelaiguebelle@gmail.com. We will respond within four weeks. We may request additional information to verify your identity.
9. Making a complaint
Are you dissatisfied with how we handle your data? Please contact us first so that we can resolve the matter together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority:
10. Cookies
This website uses cookies. How they work and your options for refusing cookies are described in our cookie statement.
11. Changes to this policy
We may amend this privacy statement from time to time — for example, when we add new services or when required by law. In the event of significant changes, we will actively inform existing customers. The date at the top of this page indicates when the last change was made.
12. Contact
Do you have any questions about this policy or how we handle your data? Please send an email to campingdelaiguebelle@gmail.com.