Privacy policy

Data controller

The controller of personal data collected via the lavana.fr and lavana.io sites is LAVANA, a SASU with a share capital of 1,000 euros, registered with the Pointe-à-Pitre Trade and Companies Register under number 108 649 518, whose registered office is at Impasse Lolo, 97111 Morne-à-l'Eau, Guadeloupe, France, represented by Kalie Vivien, president.

Contact: contact@lavana.fr

Scope of this policy

This policy covers the data collected via the lavana.fr and lavana.io marketing sites: contact forms, waitlist, quote requests and commercial booking requests.

The LAVANA client workspace (app.lavana.fr) is governed by its own contractual framework. When a merchant uses LAVANA to manage their own clients, the merchant remains the controller of those clients' data; LAVANA then acts as a processor within the meaning of Article 28 of the GDPR, under the contract binding them.

Data collected

As part of your use of the sites, LAVANA may collect the following categories of data:

• Contact form: first name, last name, email address, company, subject and content of the message
• Waitlist and availability alerts: email address
• Quote or commercial booking request: identity, contact details, description of the need, preferred time slot
• Technical security data: the host's technical logs (IP address, timestamps) used for site security and protection against fraudulent submissions

No advertising tracker or third-party audience measurement tool (Google Analytics or similar) is used. For internal statistics, our servers log each page visit (IP address, page viewed, country, referrer, browser). This data is never sold or shared, and is kept for 30 days before automatic deletion.

Purposes of processing

Your data is used exclusively to:

• Respond to your contact, quote or booking requests
• Inform you of the availability of the offers and features for which you asked to be alerted
• Ensure the security of the sites and protect against fraudulent submissions
• Comply with applicable legal and regulatory obligations

Legal bases

The processing is based on:

• Your consent · signing up to the waitlist and availability alerts
• The performance of pre-contractual measures · processing of a contact, quote or booking request initiating a commercial exchange
• Legitimate interest · site security and protection against fraudulent submissions

Recipients and processors

Your data is intended exclusively for the LAVANA team. It is processed by subprocessors strictly necessary for the operation of the sites, bound by contract in accordance with Article 28 of the GDPR:

• Vercel Inc. · site hosting (United States, governed by standard contractual clauses)
• Supabase · database where requests are stored (European Union, Paris region)
• Brevo · transactional email delivery (European Union)
• Stripe · payment of subscriptions taken out in the client workspace (United States, governed by standard contractual clauses)

No data is resold or transferred to third parties for commercial purposes.

Transfers outside the European Union

Requests submitted via the forms are stored in a database hosted in the European Union (Paris region). As the sites are hosted by Vercel Inc. (United States), and subscription payments rely on Stripe (United States), some data may be processed outside the European Economic Area. These transfers are governed by the standard contractual clauses adopted by the European Commission and, where applicable, by the EU-US Data Privacy Framework.

Retention periods

• Contact requests, quotes and commercial exchanges that did not materialize: 3 years after the last contact
• Waitlist and availability alerts: until you withdraw your consent, and at the latest 3 years after signing up without interaction
• Client data after contracting: duration of the commercial relationship + 5 years (accounting and tax obligations)
• Technical security logs: short durations defined by the host

Your rights

In accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act, you have the following rights:

• Right of access to your data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to portability of your data
• Right to object to processing, in particular for direct marketing purposes
• Right to define guidelines concerning the fate of your data after your death
• Right to withdraw your consent at any time

To exercise these rights: contact@lavana.fr · a response will be sent to you within a maximum period of one month.

Complaint to the CNIL

If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés, CNIL): cnil.fr.

Security

LAVANA implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration or disclosure: encryption of transmissions (HTTPS), access restricted to authorized persons, form rate limiting, anti-bot protections and access logging.