Privacy policy

Data controller

Karisra16, 9, passage Schneider, 92500 Rueil-Malmaison, France, reachable at contact@karisra.com.

Data collected

When you make a direct booking via this site, we collect:

• First and last name
• E-mail address
• Phone number
• Postal address (used for billing)
• Booking dates and number of guests
• Last four digits of the card, brand and issuing country (returned by Stripe for billing purposes only)

No full card data

The full card number, CVC and expiry date are never collected or stored by our services. Payment is processed directly by Stripe, Inc., acting as data processor and as data controller for its own fraud-prevention purposes.

Purposes of processing

• Managing your booking (confirmation, welcome, operational communications)
• Invoicing and accounting obligations
• Fraud prevention (via Stripe)

Legal bases

• Performance of the booking contract (GDPR, art. 6.1.b)
• Legal obligation to retain invoices (GDPR, art. 6.1.c)
• Legitimate interest in fraud prevention (GDPR, art. 6.1.f)

Retention periods

• Booking data: 3 years from end of stay
• Accounting data (invoices): 10 years (French tax law, art. L123-22 of the Commercial Code)
• Technical logs: 30 days maximum

IP addresses

No IP address is stored in our database. IP addresses are used transiently to protect our forms from abuse (rate limiting), without being stored. Our host's technical logs may contain IP addresses for up to 30 days, in line with standard web-server practices.

Cookies

This site does not use analytics or advertising cookies. Only cookies strictly necessary for payment processing (set by Stripe at the time of the transaction) may be present. These cookies expire automatically at the end of the session.

Recipients of your data

• Stripe, Inc. (United States — transfers covered by Standard Contractual Clauses) — payment processing
• Beds24 Limited (Germany) — synchronization with booking platforms when applicable
• Brevo SAS (France) — transactional e-mails when applicable
• JIKSEO EURL (France) — technical hosting and platform operation

Your rights

Under GDPR, you have the following rights:

• Access, rectification, erasure
• Restriction and opposition to processing
• Data portability
• Withdrawal of consent (where applicable)
• Complaint to the CNIL (www.cnil.fr)

To exercise these rights, write to us at contact@karisra.com.

Changes

This policy may be updated at any time. The date of the last update is shown at the bottom of the page.